Wekan CVE-2026-68899

Two specific deployment conditions must simultaneously be true: (1) the Wekan instance must have the WITH_API=true environment variable set, enabling the REST attachment upload endpoint in server/routes/attachmentApi.js; and (2) the Unix file binary must be absent from the server environment, which is common in minimal Docker/Alpine container images. When either condition is absent the vulnerability is not exploitable - deployments with file installed perform content-based MIME detection normally, and deployments without WITH_API=true do not expose the upload API path. Additionally, the attacker must hold at least board member access (CVSS PR:L), limiting exploitation to authenticated insiders or accounts compromised through other means. Exploitation also requires a victim user to open the stored attachment (CVSS UI:R), preventing fully passive exploitation. Defenders can quickly assess exposure by running 'which file' inside the container and checking the WITH_API environment variable.

The vendor-assigned CVSS 3.1 score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects the potential scope change - XSS that compromises other users' sessions including administrator accounts - and is appropriate for worst-case impact. However, AC:L understates real-world exploitation difficulty: two conditions beyond the attacker's control must simultaneously hold - the WITH_API=true environment variable must be set, and the Unix file binary must be absent. The second condition is common in Alpine/minimal Docker images but is not the universal default, making the effective attack surface narrower than AC:L implies. No EPSS score was provided in the input data, preventing quantitative exploitation probability comparison. No CISA KEV listing exists, and no independent POC has been identified - the advisory originates from a researcher-reported GitHub security advisory (GHSA-jhph-whx8-wq6p). The stored XSS impact is high when conditions are met: a low-privileged board member can achieve session theft and admin-level actions against any user who opens the attachment, which aligns with S:C/C:H/I:H. Defenders should prioritize patching container deployments but can verify exposure by checking whether WITH_API=true is set and whether the file package is installed in their images.

An authenticated Wekan board member on a container deployment lacking the file binary sets the Content-Type to image/png via the attachment API (WITH_API=true) while uploading an HTML file containing a JavaScript payload such as a session-cookie exfiltration script. Because MIME detection silently returns undefined and the spoofed type passes the deny-list check, the malicious file is stored under the Wekan origin. Any user - including administrators - who subsequently opens the attachment triggers the stored XSS, allowing the attacker to steal session tokens, perform actions on the victim's behalf, and potentially escalate to administrative control of the Wekan instance.