CVE-2026-68899

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.90

Description An issue exists where the isFileValid() function in models/fileValidation.js relies on the Unix file command for content-based MIME detection. When the file binary is unavailable, the detectMimeFromFile() function returns undefined, causing the validation to rely on the fileObj.type variable provided via the server/routes/attachmentApi.js endpoint. In deployments where WITH API=true and the file binary is missing, an authenticated board member can bypass MIME checks by labeling HTML containing JavaScript as image/png. This allows the storage of active content under the Wekan origin, which executes when accessed by another user.

Recommendations Update to version 9.90.