Path traversal in Wekan - #VU144211
Published: August 18, 2026
Vulnerability identifier: #VU144211
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from arbitrary files.
The vulnerability exists due to path traversal in board export avatar embed logic when processing an exported board containing an avatar with a client-modified versions.original.path value. A remote user can update avatar metadata to reference an arbitrary filesystem path and export a board to disclose sensitive information from arbitrary files.
The exposed file contents are embedded as base64 in users[].profile.avatarFile, and the readable scope is limited to files accessible to the Wekan process.
Affected software
Wekan
Remediation
Install security update from vendor's website.
Wekan - update to 10.74