CVE-2026-68899

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68899", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-31T21:04:04.039Z", "datePublished": "2026-08-19T19:26:06.041Z", "dateUpdated": "2026-08-21T21:49:01.859Z"}, "containers": {"cna": {"title": "Wekan: File Upload MIME Type Validation Bypass \u2014 Stored XSS via Missing System Binary Fallback", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p"}, {"name": "https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263"}, {"name": "https://github.com/wekan/wekan/releases/tag/v9.90", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/releases/tag/v9.90"}], "affected": [{"vendor": "wekan", "product": "wekan", "versions": [{"version": "< 9.90", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T19:26:06.041Z"}, "descriptions": [{"lang": "en", "value": "Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90."}], "source": {"advisory": "GHSA-jhph-whx8-wq6p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T21:00:36.236408Z", "id": "CVE-2026-68899", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:49:01.859Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68899", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T21:00:36.236408Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:00:37.386Z"}}], "cna": {"title": "Wekan: File Upload MIME Type Validation Bypass \u2014 Stored XSS via Missing System Binary Fallback", "source": {"advisory": "GHSA-jhph-whx8-wq6p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "wekan", "product": "wekan", "versions": [{"status": "affected", "version": "< 9.90"}]}], "references": [{"url": "https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p", "name": "https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263", "name": "https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wekan/wekan/releases/tag/v9.90", "name": "https://github.com/wekan/wekan/releases/tag/v9.90", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T19:26:06.041Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68899", "state": "PUBLISHED", "dateUpdated": "2026-08-21T21:49:01.859Z", "dateReserved": "2026-07-31T21:04:04.039Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T19:26:06.041Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wekan", "vendor": "wekan", "versions": [{"status": "affected", "version": "< 9.90"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90."}, {"lang": "es", "value": "Wekan es un kanban de c\u00f3digo abierto construido con Meteor. Antes de la versi\u00f3n 9.90, isFileValid() en models/fileValidation.js usaba el comando file de Unix para la detecci\u00f3n de MIME basada en contenido, pero detectMimeFromFile() devolv\u00eda undefined silenciosamente cuando ese binario no estaba disponible y la validaci\u00f3n recurr\u00eda al fileObj.type controlado por el atacante, suministrado a trav\u00e9s de server/routes/attachmentApi.js. En implementaciones con WITH_API=true y sin el binario file, un miembro de la junta autenticado pod\u00eda etiquetar HTML que conten\u00eda JavaScript como image/png, eludir la peligrosa verificaci\u00f3n MIME y almacenar contenido activo bajo el origen de Wekan para su ejecuci\u00f3n cuando otro usuario lo abriera. La versi\u00f3n 9.90 a\u00f1ade looksLikeDangerousMarkup() para inspeccionar los bytes del archivo y forzar el escaneo de contenido peligroso cuando la detecci\u00f3n de MIME no est\u00e1 disponible. Este problema est\u00e1 solucionado en la versi\u00f3n 9.90."}], "id": "CVE-2026-68899", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68899", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T21:00:36.236408Z", "version": "2.0.3"}}]}, "published": "2026-08-19T20:17:21.567", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263"}, {"source": "security-advisories@github.com", "url": "https://github.com/wekan/wekan/releases/tag/v9.90"}, {"source": "security-advisories@github.com", "url": "https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.90)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wekan", "source": "cna", "vendor": "wekan"}, "product": "wekan", "vendor": "wekan"}], "created": "2026-08-19T23:45:05.261298+00:00", "updated": "2026-08-20T12:30:05.183051+00:00", "vendors": ["wekan", "wekan$PRODUCT$wekan"]}