Wekan
CVE-2026-52890
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-reachable DDP method (AV:N/AC:L) needs a logged-in write-capable board member (PR:L); arbitrary file read gives C:H, /dev/zero DoS gives A:L, no integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.
AnalysisAI
Arbitrary file read and denial of service in Wekan (open-source Meteor kanban board) before version 9.31 allows an authenticated board member to read any file the server process can access by supplying attacker-controlled versions.original.path and versions.original.storage values to the /attachments/insert DDP method. Because the server-side insert permission rule only validates board write access and the filesystem store never confirms the path stays within the storage root, a low-privileged user can exfiltrate sensitive host files or hang the process by pointing at special files like /dev/zero. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fixing commit and release (v9.31) are public.
Technical ContextAI
Wekan is a Meteor/Node.js application that exposes server methods over DDP (Distributed Data Protocol) and stores attachment metadata in MongoDB with configurable storage backends. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the insert authorization logic in server/permissions/attachments.js checks only that the caller has board write access, while FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js opens whatever absolute path is stored in the attachment's versions.original.path field without verifying it is contained under the intended storage root. Because attachment documents are inserted client-side via DDP with attacker-supplied path and storage fields, the trust boundary between untrusted client input and the server's file-system access is crossed. The affected component is cpe:2.3:a:wekan:wekan across all versions prior to 9.31.
RemediationAI
Upgrade to the fixed release, Vendor-released patch: v9.31 (https://github.com/wekan/wekan/releases/tag/v9.31), which is applied by commit fc92b342ceedcf38dbd614a0f7b50d6dc2b22eb8 and documented in advisory GHSA-g6vm-7757-pr88. If immediate upgrade is not possible, reduce exposure by restricting who can obtain board membership (avoid granting write access to untrusted or self-registered users) and by not exposing the Wekan DDP/web interface to untrusted networks; run the Wekan process under a dedicated low-privilege OS account with a tightly scoped filesystem and mandatory access controls (AppArmor/SELinux) so that even a successful traversal cannot read sensitive host files such as credentials or /etc/shadow, and consider blocking access to device files. These controls limit blast radius but do not close the authorization gap, so patching to 9.31 remains the definitive fix.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Same weakness CWE-22 – Path Traversal
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today