Description
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kanboard | kanboard | < 1.2.31 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | kanboard | 1.2.26+ds-2+deb12u2 | DSA-5454-1 |
Advisories 1
- DSA-5454-1 kanboard - security update Debian Security (DSA / DLA) · Mar 9, 2026