SB2026091568 - Multiple vulnerabilities in Wekan

Description

This security bulletin contains information about 4 vulnerabilities.

1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose avatar images.

The vulnerability exists due to missing authorization in the Avatars collection download handler when processing library-native avatar download URLs. A remote attacker can request a full-size avatar image using a valid avatar file identifier to disclose avatar images.

The library middleware handles the three-segment download URL before WeKan\'s avatar authorization routes execute.

2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose user profile photos.

The vulnerability exists due to missing authorization in the serveLegacyAvatar function and legacy avatar file-serving routes when handling requests for legacy CollectionFS avatar file-record identifiers. A remote attacker can send a request for a legacy avatar file-record identifier to disclose user profile photos.

Exploitation requires an instance containing legacy CollectionFS avatar data and knowledge of or the ability to enumerate a legacy avatar file-record identifier.

3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to delete attachments and avatars across an instance.

The vulnerability exists due to missing authorization in the server-registered _FilesCollectionRemove_attachments and _FilesCollectionRemove_avatars DDP methods when handling unauthenticated DDP method calls. A remote attacker can invoke the methods with an empty selector to delete attachment records and physical files or avatar records.

Deleting avatars also clears each user\'s profile.avatarUrl value.

4) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write arbitrary files outside the attachment storage root.

The vulnerability exists due to path traversal in the Attachments collection namingFunction when processing attachment upload requests. A remote attacker can send a specially crafted upload request containing a traversal file identifier to write arbitrary content to an attacker-controlled path.

Remediation

Install update from vendor's website.

References

• https://github.com/wekan/wekan/security/advisories/GHSA-6h68-m988-228w
• https://github.com/wekan/wekan/security/advisories/GHSA-49wg-hc9w-fw45
• https://github.com/wekan/wekan/security/advisories/GHSA-xhc4-477v-jmg3
• https://github.com/wekan/wekan/security/advisories/GHSA-32gm-7gcp-w2c6