What is the CVSS score of CVE-2026-52891?

CVE-2026-52891 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Wekan are affected by CVE-2026-52891?

Wekan (open-source kanban board) versions before 9.07 contain a critical OS command injection vulnerability (CVE-2026-52891, CVSS 9.9) that allows authenticated users to execute arbitrary commands…

How to fix or mitigate CVE-2026-52891?

Within 24 hours: identify all Wekan deployments in use and audit which user accounts have avatar upload permissions. Within 7 days: upgrade all Wekan instances to version 9.07 or later; as interim control, disable avatar uploads or restrict upload permissions to administrators only. Within 30 days: forensically review server logs for suspicious file uploads containing shell metacharacters (backticks, $(...)), conduct a full security audit of affected systems, and implement additional input validation controls on all file upload handlers.

Wekan CVE-2026-52891

CRITICAL

OS Command Injection (CWE-78)

2026-07-15 GitHub_M

Command Injection Wekan

9.9

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable upload with low complexity but requires a valid account (PR:L); command execution runs as the app process within one authority so scope Unchanged, giving full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 22:01 vuln.today

Analysis Generated

Jul 15, 2026 - 22:01 vuln.today

CVE Published

Jul 15, 2026 - 21:08 cve.org

CRITICAL 9.9

DescriptionCVE.org

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.exec() for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename, shell metacharacters such as backticks and $() in the filename could execute commands on the server. This issue is fixed in version 9.07.

AnalysisAI

OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user execute arbitrary commands on the server by uploading an avatar with shell metacharacters in its filename. The user-supplied filename is embedded into a shell string passed to child_process.exec() for MIME-type detection in models/avatars.js and models/fileValidation.js, so backticks or $() in the name run as server-side commands. No public exploit is identified at time of analysis, but the vendor commit and advisory confirm the flaw; it is fixed in v9.07.

Technical ContextAI

Wekan performs server-side MIME-type detection on uploaded avatars by shelling out to the Unix 'file' utility (file --mime-type -b "<path>") via Node.js child_process.exec(). Because exec() spawns a shell, and the on-disk path incorporated the raw user-supplied filename, any shell metacharacter (backtick, $(), ;, |, &) in the filename was interpreted by the shell rather than treated as literal path data. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) failure: untrusted input crossing a shell boundary without escaping. The fix addresses it in two layers - sanitizing the filename to an allowlist of [a-zA-Z0-9_.-] in the naming function, and, more fundamentally, replacing exec() with execFile('file', ['--mime-type','-b', path]) so no shell is spawned and the path is passed as a discrete argv element. Affected CPE: cpe:2.3:a:wekan:wekan:*.

RemediationAI

Vendor-released patch: upgrade to Wekan 9.07 or later (https://github.com/wekan/wekan/releases/tag/v9.07), which sanitizes avatar filenames to an allowlist and replaces the shell-based exec() call with execFile() so no shell is invoked (fix commit https://github.com/wekan/wekan/commit/a4c74a5980e9f778eb444fd346f32aa3d16786a9; advisory https://github.com/wekan/wekan/security/advisories/GHSA-35j7-h385-2q9g). If immediate upgrade is not possible, restrict who can register and log in (disable open self-registration) to shrink the pool of authenticated users who can upload avatars, and place Wekan behind a trusted-network boundary or reverse proxy with authentication; these reduce exposure but do not close the bug for existing legitimate users. As a stronger stopgap, run Wekan in a hardened, minimal-privilege container so that any command execution is contained, accepting that this limits blast radius rather than preventing injection.