Hi,

The following vulnerability was published for kanboard.

At time of writing this bugreport it is unclear if upstream knows
about the issue.

CVE-2026-57862[0]:
| Kanboard 1.2.52 and prior contains a server-side request forgery
| vulnerability that allows authenticated users to bypass SSRF
| protections by supplying hexadecimal IP address notation in user-
| controlled URLs. Attackers can submit hexadecimal-encoded internal
| IP addresses through the web link creation feature, causing cURL to
| resolve and connect to internal network resources such as cloud
| instance metadata services, localhost services, and RFC1918
| addresses while the isPrivateURL() filter in
| app/Core/Http/Client.php incorrectly treats the input as safe due to
| FILTER_VALIDATE_IP rejecting non-dotted-decimal notation.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-57862
https://www.cve.org/CVERecord?id=CVE-2026-57862

Regards,
Salvatore