CVE-2026-68560 in Wekan
Summary
by MITRE • 08/19/2026
Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its {file} placeholder and executed the result through asyncExec, which is promisify(exec) and invokes `/bin/sh -c`. On deployments with an external scanner configured, an authenticated user able to upload an attachment could place shell metacharacters such as command substitutions in the filename and execute commands as the Wekan server process. Version 9.75 adds shellQuote() and passes the file path as a POSIX single-quoted argument so shell metacharacters cannot escape the placeholder. This issue is fixed in version 9.75.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in versions of Wekan prior to 9.75 represents a critical command injection flaw rooted in improper neutralization of special elements used in an operating system command, commonly classified under CWE-78. This security defect arises from the application's file validation mechanism, specifically within the models/fileValidation.js module. When users upload attachments, particularly on deployments that have configured external scanners for processing files, the system constructs a shell command by interpolating the uploaded file object path directly into an administrator-defined externalCommandLine string at a designated placeholder labeled {file}. This interpolated string is then executed via asyncExec, which serves as a promise-based wrapper around Node.js's child_process.exec function. Crucially, this execution method invokes /bin/sh -c to interpret and run the constructed command line.
The core technical flaw lies in the lack of input sanitization for the file path before its inclusion in the shell command string. Because the filename is embedded directly into a context that is interpreted by a POSIX-compliant shell, an authenticated user with upload privileges can manipulate this input. By crafting filenames containing shell metacharacters such as backticks or dollar signs used for command substitution, an attacker can break out of the intended file path argument. For instance, if the filename includes sequences like $(whoami) or `id`, these are evaluated by the shell during execution rather than being treated as literal characters in a filename. This allows the malicious user to inject arbitrary commands that are executed with the privileges of the Wekan server process, effectively granting remote code execution capabilities within the context of the application's runtime environment.
The operational impact of this vulnerability is severe due to its potential for full system compromise on the host machine running the Wekan instance. Since the injected commands run as the user account under which the Meteor-based Wekan service operates, attackers can potentially access sensitive data stored by the application, modify configuration files, or use the compromised server as a pivot point for further attacks against other systems within the network infrastructure. The requirement for authentication limits the attack surface to legitimate users who have been granted permission to upload attachments, but given that many organizations allow broad file sharing capabilities in kanban tools, this restriction does not significantly mitigate the risk if user accounts are compromised or shared credentials are used.
This issue was addressed in version 9.75 through a robust remediation strategy aligned with secure coding practices for command execution. The fix introduces a shellQuote() function that properly escapes and quotes the file path argument before it is passed to the external scanner. By passing the file path as a POSIX single-quoted argument, the application ensures that any special characters within the filename are treated literally by /bin/sh -c rather than being interpreted as control structures or command separators. This approach effectively neutralizes shell injection attempts because the metacharacters remain enclosed within quotes and do not influence the execution flow of the parent command. Organizations running Wekan must upgrade to version 9.75 or later immediately to mitigate this risk, while also ensuring that external scanner configurations are reviewed for any other potential injection vectors in future development cycles.