Bug#1143159: kanboard: CVE-2026-57862

Source: kanboard
Version: 1.2.51+ds-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for kanboard.

At time of writing this bugreport it is unclear if upstream knows
about the issue.

CVE-2026-57862[0]:
| Kanboard 1.2.52 and prior contains a server-side request forgery
| vulnerability that allows authenticated users to bypass SSRF
| protections by supplying hexadecimal IP address notation in user-
| controlled URLs. Attackers can submit hexadecimal-encoded internal
| IP addresses through the web link creation feature, causing cURL to
| resolve and connect to internal network resources such as cloud
| instance metadata services, localhost services, and RFC1918
| addresses while the isPrivateURL() filter in
| app/Core/Http/Client.php incorrectly treats the input as safe due to
| FILTER_VALIDATE_IP rejecting non-dotted-decimal notation.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-57862
    https://www.cve.org/CVERecord?id=CVE-2026-57862

Regards,
Salvatore