CVE-2026-68560

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.75

Description An authenticated user with attachment upload privileges can execute arbitrary commands as the Wekan server process on deployments where an external scanner is configured. The issue occurs in models/fileValidation.js when the fileObj.path variable is interpolated into the externalCommandLine at the {file} placeholder and executed via asyncExec (a promisified version of exec that invokes /bin/sh -c). An attacker can exploit this by including shell metacharacters, such as command substitutions, within the filename of the uploaded file.

Recommendations Update Wekan to version 9.75 or later.