Homepage

Cross-site Scripting (XSS) The advisory has been revoked - it doesn't affect any version of package kanboard  (opens in a new tab)

Threat Intelligence

EPSS
0.34% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN14-KANBOARD-12905488
  • published19 Sept 2025
  • disclosed12 May 2025
Report a new vulnerability Found a mistake?

Introduced: 12 May 2025

CVE-2025-46825  (opens in a new tab)
CWE-79  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:14.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kanboard package and not the kanboard package as distributed by Debian.

Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the name parameter of the http://localhost/?controller=ProjectCreationController&action=create form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue.