CVE-2026-52891: Wekan Avatar Upload RCE Vulnerability

CVE-2026-52891 Overview

CVE-2026-52891 is a command injection vulnerability [CWE-78] in Wekan, an open-source kanban board built with Meteor. Versions prior to 9.07 embed user-supplied avatar filenames into shell commands executed by child_process.exec() for MIME-type detection. An authenticated attacker can craft a filename containing shell metacharacters such as backticks or $() to execute arbitrary commands on the Wekan server. The vulnerability resides in models/avatars.js and models/fileValidation.js, which invoke the file --mime-type utility through a shell. Version 9.07 remediates the flaw by switching to execFile and sanitizing filename input.

Critical Impact
A low-privileged authenticated user can achieve remote code execution on the Wekan server by uploading an avatar with a malicious filename, leading to full compromise of the application host.

Affected Products

Wekan versions prior to 9.07
models/avatars.js file-handling component
models/fileValidation.js MIME-detection component

Discovery Timeline

2026-07-15 - CVE-2026-52891 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-52891

Vulnerability Analysis

Wekan performs server-side MIME-type detection on uploaded avatars by shelling out to the Unix file utility. The pre-patch implementation built the command as a template string incorporating the uploaded filename, then invoked child_process.exec(), which spawns /bin/sh -c to interpret the command. Because filenames were only escaped for double quotes, attackers could inject shell metacharacters that break out of the quoted argument and execute arbitrary shell commands. The sanitize() function in models/avatars.js explicitly returned the original filename without modification, allowing dangerous characters to persist through the upload pipeline.

Root Cause

The root cause is a classic OS command injection [CWE-78]: untrusted input flows into a shell interpreter without adequate sanitization. Two design choices amplify the flaw. First, exec() was used instead of execFile(), invoking a shell that interprets metacharacters. Second, the sanitize() helper was a no-op, preserving characters such as `, $, ;, |, and & in filenames that later became part of on-disk paths and shell arguments.

Attack Vector

An authenticated Wekan user uploads an avatar image whose filename contains shell metacharacters. When the server processes the upload, detectMimeFromFile() constructs a command similar to file --mime-type -b "<attacker-controlled-path>" and passes it to exec(). The shell parses embedded backticks or $() sequences, executing the enclosed payload with the privileges of the Wekan Node.js process.

javascript

// Vulnerable pattern (pre-9.07) in models/fileValidation.js
const escapedPath = String(filePath).replace(/"/g, '\\"');
const { stdout } = await asyncExec(`file --mime-type -b "${escapedPath}"`);

// Patched pattern (9.07) — execFile bypasses the shell entirely
const { stdout } = await asyncExecFile('file', ['--mime-type', '-b', String(filePath)]);

Source: GitHub Wekan Commit a4c74a5

Detection Methods for CVE-2026-52891

Indicators of Compromise

Avatar files stored on disk whose names contain shell metacharacters such as `, $(, ;, |, &, or newline characters.
Unexpected child processes spawned by the Wekan Node.js process, particularly /bin/sh invocations followed by non-file commands.
Outbound network connections originating from the Wekan host to unknown destinations shortly after avatar upload requests.
Web server access logs showing POST requests to avatar upload endpoints with unusual filename parameters in multipart bodies.

Detection Strategies

Inspect the avatar storage directory for filenames that do not match the safe pattern [a-zA-Z0-9_.\-]+.
Correlate authenticated Wekan upload events with process-creation telemetry showing shell invocations under the Wekan service account.
Alert on any child process of the Wekan Node.js runtime other than the expected file binary during avatar handling.

Monitoring Recommendations

Enable process-execution auditing on the host running Wekan and forward events to a centralized logging platform.
Track file uploads with anomalous filename characters at the reverse proxy or WAF layer.
Monitor Wekan server outbound network activity for connections that do not match established baselines.

How to Mitigate CVE-2026-52891

Immediate Actions Required

Upgrade all Wekan deployments to version 9.07 or later without delay.
Audit existing avatar storage for files with unsafe names and remove or rename them.
Rotate any secrets, API tokens, or credentials accessible to the Wekan process if exploitation is suspected.
Restrict network egress from the Wekan host to limit post-exploitation options for attackers.

Patch Information

The fix is available in Wekan release v9.07 and is described in GitHub Security Advisory GHSA-35j7-h385-2q9g. The remediation commit a4c74a5 replaces exec() with execFile() in models/fileValidation.js and enforces a [^a-zA-Z0-9_.\-] character allowlist in models/avatars.js.

Workarounds

If immediate patching is not feasible, disable avatar upload functionality at the reverse proxy by blocking the upload route.
Enforce filename sanitization at an upstream WAF, rejecting requests where the multipart filename field contains characters outside [a-zA-Z0-9_.\-].
Run the Wekan process under a dedicated low-privilege account with a restrictive seccomp or AppArmor profile to limit the blast radius of injected commands.

bash

# Verify Wekan version and confirm patched release
docker exec wekan cat /build/package.json | grep '"version"'
# Expected output: "version": "9.07" or later

# Audit avatar storage for suspicious filenames (adjust path as needed)
find /var/lib/wekan/uploads -type f ! -regex '.*/[a-zA-Z0-9_.\-]+$'