CVE-2026-52891 Details

A remote code execution vulnerability exists in Wekan versions prior to 9.07. The issue arises in the avatar upload feature, where user-provided filenames are incorporated into file paths that are subsequently used with child_process.exec() for MIME type detection. This creates an opportunity for shell metacharacters, such as backticks and command substitution syntax, to be executed on the server. Although a similar vulnerability in file attachments was addressed, the avatar upload issue remained unpatched until version 9.07.

Users can update to Wekan version 9.07 or later, where this vulnerability has been fixed. For those maintaining their own Wekan instances, it is recommended to sanitize filenames by removing non-alphanumeric characters before storing them, use the child_process.execFile() method instead of exec() to prevent shell injection, and apply the same fix used for regular file attachments by using only MongoDB ObjectIDs in avatar file paths.