Arbitrary file upload in Wekan - CVE-2026-68899
Published: July 28, 2026 / Updated: August 21, 2026
Vulnerability identifier: #VU139846
CSH Severity: Medium
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68899
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in victims' browsers.
The vulnerability exists due to unrestricted upload of file with dangerous type in the file upload validation function isFileValid() when processing attachment upload requests on servers where MIME detection falls back to a user-controlled file type value. A remote user can upload a crafted HTML file while spoofing its MIME type to execute arbitrary JavaScript in victims' browsers.
Exploitation requires user interaction to access the uploaded attachment, and only instances with the API enabled and without the system file command available are vulnerable.
Affected software
Wekan
How to mitigate CVE-2026-68899
Install security update from vendor's website.
Wekan - update to 9.90