CVE-2026-52890: Wekan: Arbitrary file read and server DoS via attachment versions.original.path
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 9.31
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52890?
CVE-2026-52890 has a high severity rating of 7.1.
How do I fix CVE-2026-52890?
To fix CVE-2026-52890, you should update Wekan to version 9.31 or later.
What are the potential impacts of CVE-2026-52890?
The potential impacts of CVE-2026-52890 include arbitrary file reading and Denial of Service (DoS) to the server.
Who is affected by CVE-2026-52890?
Logged-in board members of Wekan prior to version 9.31 are affected by CVE-2026-52890.
What type of vulnerability is CVE-2026-52890?
CVE-2026-52890 is a Path Traversal vulnerability that allows manipulation of attachment paths.