CVE-2026-52890: Wekan Path Traversal Vulnerability

CVE-2026-52890 Overview

CVE-2026-52890 is a path traversal vulnerability [CWE-22] in Wekan, an open source kanban board built with Meteor. Versions prior to 9.31 allow an authenticated board member to insert an attachment document via the /attachments/insert Distributed Data Protocol (DDP) method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule only validates board write access. The FileStoreStrategyFilesystem.getReadStream() function in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check. This enables arbitrary file reads and denial of service through special files such as /dev/zero. The issue is fixed in version 9.31.

Critical Impact
Authenticated board members can read arbitrary files from the Wekan server filesystem and trigger denial of service by referencing device files like /dev/zero.

Affected Products

Wekan versions prior to 9.31
Wekan open source kanban (Meteor-based deployments)
Self-hosted Wekan instances exposing DDP endpoints

Discovery Timeline

2026-07-15 - CVE-2026-52890 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-52890

Vulnerability Analysis

The flaw resides in Wekan's attachment insertion pipeline. Wekan uses Meteor's DDP protocol to synchronize collection state between clients and the server. The /attachments/insert method accepts a document that includes versions.original.path and versions.original.storage fields describing where the underlying file lives on disk.

The server-side authorization rule in server/permissions/attachments.js verifies that the caller has write access to the target board. It does not validate the content of the path or storage fields supplied by the client. When a client later requests the attachment, FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js opens the stored path directly and streams its contents.

Because no containment check confirms that the resolved path stays inside the configured attachment storage root, an attacker can point the field at any file readable by the Wekan process. Referencing pseudo-files such as /dev/zero produces an unbounded stream that exhausts server resources.

Root Cause

The root cause is missing input validation and missing filesystem containment enforcement. Trust boundaries are broken twice: the insert permission rule trusts client-provided storage metadata, and the read-stream function trusts stored paths without canonicalizing them against an allowed storage root.

Attack Vector

Exploitation requires network access to the Wekan DDP endpoint and a valid account with write access to at least one board. The attacker calls /attachments/insert with a crafted document setting versions.original.storage to filesystem and versions.original.path to an absolute path outside the attachment directory. Subsequent attachment downloads return the referenced file contents.

text

// Patch excerpt from .meteor/versions - Fix GHSA-g6vm-7757-pr88
 accounts-base@3.3.0-beta350.12
 accounts-oauth@1.4.7-beta350.12
 accounts-password@3.3.0-beta350.12
+accounts-express@1.0.0-beta350.12
 aldeed:collection2@4.1.5
 aldeed:schema-index@4.0.0
 aldeed:simple-schema@1.13.1

Source: Wekan commit fc92b342. The fix moves attachment storage options from board-level configuration to an admin-controlled panel, removing the ability of ordinary board members to influence storage location.

Detection Methods for CVE-2026-52890

Indicators of Compromise

DDP /attachments/insert calls where versions.original.path contains absolute paths outside the configured Wekan attachment directory.
Attachment records in MongoDB whose versions.original.path references system locations such as /etc/, /root/, /proc/, or /dev/.
Sustained high CPU or memory consumption on the Wekan server correlated with attachment download requests referencing device files.

Detection Strategies

Audit the cfs.attachments.filerecord collection for documents where the stored path does not resolve inside the intended attachment storage root.
Enable DDP method-call logging and alert on /attachments/insert payloads containing suspicious path characters such as .., absolute paths, or /dev/ prefixes.
Correlate attachment download activity with process-level file access telemetry to identify reads of files outside the storage directory.

Monitoring Recommendations

Monitor Wekan application logs for unusual attachment sizes or long-running download streams.
Track outbound data volume per authenticated session to detect bulk exfiltration through crafted attachment reads.
Alert on the Wekan process opening files under sensitive directories such as /etc, /root, or /var/lib.

How to Mitigate CVE-2026-52890

Immediate Actions Required

Upgrade all Wekan instances to version 9.31 or later without delay.
Review existing attachment records for paths outside the configured storage root and remove any tampered entries.
Rotate secrets and credentials that could have been read from the Wekan host filesystem.
Restrict board membership to trusted users until the patch is applied.

Patch Information

The vulnerability is fixed in Wekan version 9.31. The upstream fix, tracked as GHSA-g6vm-7757-pr88, moves attachment storage configuration to admin-only settings and enforces storage-root containment on read. Release notes are available in the Wekan v9.31 release and the underlying commit fc92b342.

Workarounds

Run Wekan under a dedicated low-privilege system account with filesystem access limited to its data directory.
Deploy Wekan inside a container or chroot with no bind mounts to host paths outside the attachment store.
Place Wekan behind a reverse proxy that inspects DDP traffic and blocks attachment insert payloads containing absolute or traversal path patterns.
Disable public registration and audit board membership until the upgrade is completed.

bash

# Verify running Wekan version and upgrade via Docker
docker inspect wekan --format '{{ .Config.Image }}'
docker pull wekanteam/wekan:v9.31
docker stop wekan && docker rm wekan
docker run -d --name wekan --read-only \
  --tmpfs /tmp \
  -v /srv/wekan/data:/data \
  -p 127.0.0.1:8080:8080 \
  wekanteam/wekan:v9.31