Vulnerability Description
Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263
- https://github.com/wekan/wekan/releases/tag/v9.90
- https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p
FAQ
What is CVE-2026-68899?
CVE-2026-68899 is a vulnerability with a CVSS score of 8.7 (HIGH). Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently r...
How severe is CVE-2026-68899?
CVE-2026-68899 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-68899?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.