Command Injection Vulnerability in Wekan Kanban Software

CVE-2026-68560

What is CVE-2026-68560?

Wekan, an open-source kanban board tool, contains a command injection vulnerability that allows authenticated users to execute arbitrary commands through crafted filenames in file uploads. Prior to version 9.75, the application inadequately processed uploaded file paths, enabling users to exploit shell metacharacters, including command substitutions. This vulnerability can lead to severe security concerns if exploited. The release of version 9.75 introduces crucial security enhancements by sanitizing file paths using shellQuote() to mitigate this risk effectively.

References