Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-68899Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

High 8.7

In plain English

A high-severity unrestricted file upload in wekan from wekan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.5%top 55.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.

Affected products (as reported)

Vendor	Product	Versions
wekan	wekan	< 9.90

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263 x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.90 x_refsource_MISC