CVE-2026-68560: Wekan Kanban RCE Vulnerability

CVE-2026-68560 Overview

CVE-2026-68560 is a shell command injection vulnerability in Wekan, an open source kanban board built with Meteor. Versions prior to 9.75 interpolated uploaded file paths into an administrator-configured external scanner command line and executed the result through /bin/sh -c. Authenticated users able to upload attachments on deployments with an external scanner configured could inject shell metacharacters through the filename. The injected commands execute with the privileges of the Wekan server process. The issue is tracked as [CWE-78] and is fixed in version 9.75.

Critical Impact
Authenticated attackers can achieve remote code execution as the Wekan server process by uploading files with crafted names containing shell metacharacters.

Affected Products

Wekan versions prior to 9.75
Deployments with the externalCommandLine scanner configured
Self-hosted Wekan instances accepting attachment uploads

Discovery Timeline

2026-08-19 - CVE-2026-68560 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-68560

Vulnerability Analysis

The vulnerability resides in models/fileValidation.js, which handles attachment scanning through an administrator-configurable external command. Wekan interpolated the uploaded fileObj.path value directly into the externalCommandLine string at its {file} placeholder. The resulting string was passed to asyncExec, a promisify(exec) wrapper that invokes /bin/sh -c. Because the shell parses the interpolated path, any metacharacters embedded in the filename are interpreted as shell syntax rather than as literal characters. This exposes the server to arbitrary command execution triggered by a malicious upload.

Root Cause

The root cause is unsafe string interpolation of untrusted input into a shell command. Wekan performed no quoting or escaping on the file path before substitution. Shell metacharacters such as backticks, $() command substitutions, semicolons, and pipes retained their special meaning when the constructed string reached /bin/sh. This is a textbook OS command injection weakness classified under [CWE-78].

Attack Vector

An authenticated user with upload permission crafts a filename containing shell metacharacters, for example a command substitution such as $(id). When the attachment is processed, Wekan builds the scanner command by replacing {file} with the attacker-controlled path. The shell evaluates the embedded substitution before executing the scanner, running the injected command as the Wekan server user. The exploit requires network access, valid credentials, and an administrator to have configured externalCommandLine.

javascript

   asyncExec = promisify(exec);
 }
 
+// POSIX-safe shell quoting for a single argument.  Wraps the value in single
+// quotes and escapes any embedded single quote as '\'' .  Inside single quotes
+// the shell interprets no metacharacters ($ ` \ ; | & > < * ? ( ) etc.), so the
+// value cannot break out of the argument or inject additional commands.  This is
+// used for the file path interpolated into the admin-configured external scanner
+// command line, which is executed through /bin/sh (CWE-78 shell injection).
+function shellQuote(value) {
+  return "'" + String(value).replace(/'/g, "'\\''") + "'";
+}
+
 async function detectMimeFromFile(filePath) {
   if (!Meteor.isServer) return undefined;

Source: GitHub Wekan Commit 1a222c4

Detection Methods for CVE-2026-68560

Indicators of Compromise

Attachment records with filenames containing shell metacharacters such as backticks, $(...), ;, |, &, >, or <.
Child processes of the Wekan Node.js process spawning /bin/sh -c with unexpected command tails.
Unusual outbound network connections initiated by the Wekan server user shortly after file uploads.
Scanner invocations recorded in Wekan logs referencing filenames with non-standard characters.

Detection Strategies

Audit uploaded attachment names in the Wekan database for shell metacharacters and command substitution syntax.
Monitor process trees on Wekan hosts for sh or bash children of the Node.js runtime executing non-scanner binaries.
Correlate file upload API calls with subsequent process execution events on the host.

Monitoring Recommendations

Enable process auditing on Wekan servers, capturing execve arguments to record shell command lines.
Forward Wekan application logs and host telemetry to a centralized SIEM for correlation between uploads and process spawns.
Alert on any command line executed by the Wekan service that does not match the configured externalCommandLine template.

How to Mitigate CVE-2026-68560

Immediate Actions Required

Upgrade Wekan to version 9.75 or later, which introduces shellQuote() to safely quote the interpolated file path.
If patching is not immediately possible, disable the external scanner by clearing the externalCommandLine administrator setting.
Review existing attachments for filenames containing shell metacharacters and investigate the associated user accounts.

Patch Information

Version 9.75 adds a shellQuote() helper that wraps the file path as a POSIX single-quoted argument before substitution into externalCommandLine. Inside single quotes the shell interprets no metacharacters, preventing the filename from breaking out of its argument boundary. Details are available in the GitHub Security Advisory GHSA-x3xm-pxrv-jg7p and the Wekan v9.75 release notes.

Workarounds

Remove or leave empty the externalCommandLine configuration until the upgrade is applied.
Restrict attachment upload permissions to trusted users only while the vulnerable version is deployed.
Run Wekan as an unprivileged, sandboxed service account to reduce the blast radius of any successful exploitation.

bash

# Configuration example: disable the external scanner until upgrade
unset EXTERNAL_COMMAND_LINE
# Then restart the Wekan service
systemctl restart wekan