CVE-2026-68899

Received Received - Intake

MIME Bypass via File Command Absence in Wekan

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-68899

EUVD

EUVD-2026-62706

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	9.90

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in Wekan, an open-source Kanban board. It occurs when Wekan is deployed in environments like Docker without the Unix 'file' command installed. The application relies on this command to detect file MIME types but silently falls back to a user-controlled MIME type when the command is missing. An attacker can upload a malicious HTML file disguised as a harmless image, bypassing security checks. When other users access the file, the embedded JavaScript executes due to incorrect MIME type handling.

Detection Guidance

Check if the Unix 'file' command is installed on your Wekan server by running 'which file' or 'file --version'. If missing, Wekan may be vulnerable. Inspect uploaded files for spoofed MIME types by comparing actual file content with the claimed type. Look for HTML/SVG/XML content disguised as images in file storage directories.

Impact Analysis

This vulnerability can lead to session hijacking, privilege escalation, or other malicious actions if an authenticated user with elevated permissions interacts with the malicious file. Attackers could steal sessions, perform unauthorized actions, or escalate their privileges within the Wekan application.

Mitigation Strategies

Upgrade Wekan to version 9.90 or later. Install the Unix 'file' command on your system if missing. Disable the WITH_API environment variable if not required. Review uploaded files for suspicious content and remove any malicious files. Monitor logs for warnings about missing 'file' command.

Hi! I’m here to help you understand CVE-2026-68899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70