CVE-2026-52891
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Wekan before version 9.07 has a command injection vulnerability in the avatar upload functionality. User-supplied filenames are passed to child_process.exec() without sanitization, allowing shell metacharacters like backticks and $() to execute arbitrary commands on the server.
Risk Assessment
An attacker can gain full control of the server by executing arbitrary system commands, leading to complete compromise of data and services.
Recommendation
Immediately upgrade Wekan to version 9.07 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.exec() for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename, shell metacharacters such as backticks and $() in the filename could execute commands on the server. This issue is fixed in version 9.07.