File Type Validation Vulnerability in Wekan Kanban by Wekan

CVE-2026-68899

What is CVE-2026-68899?

Wekan, an open-source kanban tool built with Meteor, exhibits a serious file validation flaw prior to version 9.90. The function isFileValid() relied on the Unix file command for MIME type detection; however, if the file command was absent, the detection process fell back to using the type field from the user-controlled fileObj. This allowed authenticated users to masquerade HTML content containing JavaScript as a safe image/png, thereby bypassing MIME checks. Consequently, malicious scripts could be executed when the file was accessed by another user. Version 9.90 introduces a new method, looksLikeDangerousMarkup(), to enhance safety by inspecting file content and enforcing checks for potentially dangerous attachments.

References