CVE-2026-52890

Received Received - Intake

Path Traversal in Wekan Kanban

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-07-16

AI Q&A

2026-07-16

EPSS Evaluated

N/A

NVD

CVE-2026-52890

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	9.31

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Mitigation Strategies

Immediately upgrade Wekan to version 9.31 or later to patch the vulnerability. Ensure no unauthorized file access has occurred by reviewing system logs for unusual activity.

Executive Summary

Wekan is an open-source kanban tool. A vulnerability exists in versions before 9.31 where a logged-in board member can exploit the /attachments/insert method to insert malicious file paths. The server checks only for board write permissions but fails to validate the file path properly. This allows attackers to read arbitrary files or cause denial of service by accessing special files like /dev/zero.

Impact Analysis

An attacker with board access could read sensitive files on the server, including configuration files or other data. They could also cause system instability by consuming resources with files like /dev/zero, leading to denial of service.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using vulnerable versions may face compliance violations and legal consequences.

Detection Guidance

This vulnerability can be detected by checking the Wekan version installed on your system. If the version is below 9.31, the system is vulnerable. Run the command: wekan --version or check the package manager for Wekan version.

Hi! I’m here to help you understand CVE-2026-52890. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70