Arbitrary file upload in Wekan - #VU139846
Published: July 28, 2026
Vulnerability identifier: #VU139846
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: wekan.github.io
Affected software:
Wekan
Wekan
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary JavaScript in victims' browsers.
The vulnerability exists due to unrestricted upload of file with dangerous type in the file upload validation function isFileValid() when processing attachment upload requests on servers where MIME detection falls back to a user-controlled file type value. A remote user can upload a crafted HTML file while spoofing its MIME type to execute arbitrary JavaScript in victims' browsers.
Exploitation requires user interaction to access the uploaded attachment, and only instances with the API enabled and without the system file command available are vulnerable.
Remediation
Install security update from vendor's website.