Wekan
CVE-2026-52890
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as board member with write access
-
DeliveryCall /attachments/insert DDP method
-
ExploitSet versions.original.path to target file and storage to filesystem
-
ExecutionBypass missing storage-root containment check
-
PersistRetrieve attachment to read arbitrary file or stream /dev/zero
-
ImpactExfiltrate sensitive data or cause denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated Wekan account that is a member of at least one board with write access, and requires the server to be using the filesystem attachment storage strategy that FileStoreStrategyFilesystem.getReadStream() serves. The attacker must reach the /attachments/insert DDP method (network-accessible per AV:N) and supply crafted versions.original.path and versions.original.storage values. Limiting factors: it is not unauthenticated (a valid, write-capable board member is needed), so instances that tightly control board membership sharply reduce exposure; arbitrary-read impact is bounded by the filesystem permissions of the Wekan process account; and the specific getReadStream traversal targets the filesystem backend rather than object-storage (S3/GridFS) configurations. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 7.1) aligns well with the described mechanics: network-reachable DDP endpoint, low attack complexity, and low privileges (any logged-in board member with write access), yielding high confidentiality impact (arbitrary file read) plus low availability impact (DoS via /dev/zero) and no integrity impact. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals are unknown rather than low. The practical priority is moderate-to-high for organizations running multi-tenant or internet-exposed Wekan instances where untrusted users can obtain board membership, because the barrier (a normal member account) is realistic; it is lower for tightly controlled internal deployments. Note one nuance to verify: PR:L assumes the attacker already has board write access, so the real-world exposure depends on how freely board membership is granted in a given deployment. |
| Exploit ScenarioDerived | An attacker who holds (or is granted) ordinary write-level membership on any Wekan board calls the /attachments/insert DDP method with versions.original.storage set to the filesystem strategy and versions.original.path pointing at a sensitive host file such as /etc/passwd or an application config file, then downloads the attachment to exfiltrate its contents. The same technique aimed at /dev/zero causes the server to stream endlessly, producing a denial-of-service condition. No public exploit code has been identified, but the low complexity (AC:L) and lack of user interaction make weaponization straightforward for anyone with board access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Arbitrary file read and denial of service in Wekan (open-source Meteor kanban board) before version 9.31 allows an authenticated board member to read any file the server process can access by supplying attacker-controlled versions.original.path and versions.original.storage values to the /attachments/insert DDP method. Because the server-side insert permission rule only validates board write access and the filesystem store never confirms the path stays within the storage root, a low-privileged user can exfiltrate sensitive host files or hang the process by pointing at special files like /dev/zero. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but a fixing commit and release (v9.31) are public.
RemediationAI
Upgrade to the fixed release, Vendor-released patch: v9.31 (https://github.com/wekan/wekan/releases/tag/v9.31), which is applied by commit fc92b342ceedcf38dbd614a0f7b50d6dc2b22eb8 and documented in advisory GHSA-g6vm-7757-pr88. If immediate upgrade is not possible, reduce exposure by restricting who can obtain board membership (avoid granting write access to untrusted or self-registered users) and by not exposing the Wekan DDP/web interface to untrusted networks; run the Wekan process under a dedicated low-privilege OS account with a tightly scoped filesystem and mandatory access controls (AppArmor/SELinux) so that even a successful traversal cannot read sensitive host files such as credentials or /etc/shadow, and consider blocking access to device files. These controls limit blast radius but do not close the authorization gap, so patching to 9.31 remains the definitive fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wekan is a Meteor/Node.js application that exposes server methods over DDP (Distributed Data Protocol) and stores attachment metadata in MongoDB with configurable storage backends. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the insert authorization logic in server/permissions/attachments.js checks only that the caller has board write access, while FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js opens whatever absolute path is stored in the attachment's versions.original.path field without verifying it is contained under the intended storage root. Because attachment documents are inserted client-side via DDP with attacker-supplied path and storage fields, the trust boundary between untrusted client input and the server's file-system access is crossed. The affected component is cpe:2.3:a:wekan:wekan across all versions prior to 9.31.
Know when Wekan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network-reachable DDP method (AV:N/AC:L) needs a logged-in write-capable board member (PR:L); arbitrary file read gives C:H, /dev/zero DoS gives A:L, no integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.
Executive ViewAI
Wekan kanban board (versions before 9.31) allows authenticated board members to read any file accessible to the server process, creating risk of sensitive data exfiltration including credentials and configurations. Organizations with shared Wekan boards involving contractors, vendors, or extended teams face elevated breach risk even from low-privileged members. Vendor patch v9.31 is available and should be deployed immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Privilege escalation in the self-hosted Wekan kanban board through version 18.15 allows any authenticated user to rewrit
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Exploit-DB