Description

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-19T20:17:21.567Z",
  "pubdate": "2026-08-19T20:17:21.567Z",
  "executiveSummary": "An arbitrary file upload and stored cross-site scripting vulnerability affects Wekan prior to version 9.90. The vulnerability allows authenticated board members to bypass dangerous MIME type validation checks under specific deployment conditions, leading to the execution of attacker-controlled JavaScript within the Wekan origin.\nThe flaw stems from insecure fallback handling in the file validation logic when the Unix file binary is unavailable on the host system. Attackers with authenticated board member access can leverage this weakness by supplying a crafted file containing active HTML and JavaScript while manipulating the fileObj.type parameter to mimic a safe asset like an image/png.\nExploitation requires the deployment to have the API enabled via WITH_API=true and the host system missing the file binary dependency. Successful execution results in stored cross-site scripting when another authenticated user accesses the malicious resource within the application context, compromising session integrity and enabling unauthorized actions within the affected Wekan instance.\nRemediation requires upgrading Wekan to version 9.90 or later, which introduces robust byte-level inspection mechanisms via looksLikeDangerousMarkup() to enforce strict security checks regardless of external binary dependencies.",
  "technicalDetails": "The vulnerability resides in the file validation component of Wekan, specifically within the isFileValid() function located in models/fileValidation.js and the route handler in server/routes/attachmentApi.js. Prior to version 9.90, the application attempted to perform content-based MIME type detection using the standard Unix file command.\nThe root cause of the vulnerability is the insecure error-handling and fallback mechanism implemented in detectMimeFromFile(). When the underlying Unix file binary is absent from the deployment environment, detectMimeFromFile() silently returns undefined rather than failing closed. Consequently, the validation routine falls back to trusting the attacker-controlled fileObj.type parameter supplied directly through the attachment API routes.\nExploitation requires specific preconditions, including an active deployment configuration with WITH_API=true and an underlying operating system environment lacking the file binary. An authenticated attacker with board member privileges initiates the attack flow by uploading a specially crafted file containing active HTML markup embedded with malicious JavaScript payloads. The attacker explicitly labels this payload as image/png within the request metadata.\nBecause the MIME detection binary is missing, the application defaults to accepting the attacker-supplied MIME type, bypassing the dangerous content validation checks. The malicious file is subsequently stored within the application storage backend under the legitimate Wekan origin.\nPost-exploitation impact materializes when another user or administrator views or interacts with the stored attachment. The malicious HTML and JavaScript execute within the victim's browser context under the Wekan origin, potentially leading to session hijacking, unauthorized API actions, or further compromise of the affected board and system resources.\nAffected software versions include all Wekan deployments prior to version 9.90. The vulnerable components involve server/routes/attachmentApi.js and models/fileValidation.js. Authentication as a board member is required, and network exposure is dictated by the availability of the application's API endpoints."
}