CVE-2026-68899: Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback
Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITHAPI=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 9.90
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running versions before 9.90 are exposed when WITH_API=true and the Unix file binary is unavailable. The vulnerable path is the attachment API handling uploads.
What does an attacker need to exploit it?
The attacker needs an authenticated Wekan account with board-member access and must be able to upload an attachment through the affected API. They can claim malicious HTML is image/png, after which another user must open the uploaded content for the stored JavaScript to execute.
How can I tell whether temporary mitigation is needed?
Check whether the instance is older than 9.90, has WITH_API=true, and lacks the Unix file command used for content-based MIME detection. That combination causes validation to rely on the attacker-controlled MIME type.
What should be done if upgrading cannot happen immediately?
Ensure the Unix file binary is installed and available to the Wekan process so content-based MIME detection can run. Restricting access to the affected attachment API or preventing untrusted attachment uploads also reduces exposure until version 9.90 can be deployed.