CVE-2026-52890

HIGH 7.1

Wekan: Arbitrary file read and server DoS via attachment versions.original.path

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.

CWE	CWE-22 CWE-400
Vendor	wekan
Product	wekan
Published	Jul 15, 2026
Last Updated	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for wekan wekan

Be the first to know when new high vulnerabilities affecting wekan wekan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Affected Versions

wekan / wekan

< 9.31

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/wekan/wekan/security/advisories/GHSA-g6vm-7757-pr88 github.com: https://github.com/wekan/wekan/commit/fc92b342ceedcf38dbd614a0f7b50d6dc2b22eb8 github.com: https://github.com/wekan/wekan/releases/tag/v9.31