CVE-2026-21879

Katalog CVE

CVSS 6.1 · Medium EPSS 0,31%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada kanboard. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f patch
• https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq exploit · advisory pihak ketiga
• https://github.com/kanboard/kanboard/releases/tag/v1.2.49 release notes