CVE-2026-52890 Details

A vulnerability in Wekan, an open-source kanban application built with Meteor, allows logged-in board members to exploit the attachment handling feature. Prior to version 9.31, the application did not properly validate file attachment paths before processing them. This oversight enabled users to insert attachments with arbitrary file paths, leading to unauthorized file reads and potential denial-of-service conditions by targeting specific system files. The issue arises from inadequate permission checks on the attachment 'versions' metadata during the insertion of files via the DDP method '/attachments/insert'.

Users can upgrade to Wekan version 9.31, which addresses this vulnerability by implementing proper validation of attachment paths and restricting file reads to authorized storage locations.