SB2026072851 - Arbitrary file upload in Wekan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072851

SB2026072851 - Arbitrary file upload in Wekan

Published: July 28, 2026

Security Bulletin ID SB2026072851
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Arbitrary file upload (CVE-ID: N/A)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary JavaScript in victims' browsers.

The vulnerability exists due to unrestricted upload of file with dangerous type in the file upload validation function isFileValid() when processing attachment upload requests on servers where MIME detection falls back to a user-controlled file type value. A remote user can upload a crafted HTML file while spoofing its MIME type to execute arbitrary JavaScript in victims' browsers.

Exploitation requires user interaction to access the uploaded attachment, and only instances with the API enabled and without the system file command available are vulnerable.


Remediation

Install update from vendor's website.

References