CVE-2026-68899: Wekan Kanban XSS Vulnerability

CVE-2026-68899 Overview

CVE-2026-68899 is a stored cross-site scripting (XSS) vulnerability in Wekan, an open source kanban board built with Meteor. The flaw resides in the isFileValid() function within models/fileValidation.js, which relies on the Unix file command for content-based MIME detection. When the file binary is unavailable, detectMimeFromFile() silently returns undefined, causing validation to fall back to the attacker-controlled fileObj.type value supplied through server/routes/attachmentApi.js. This weakness is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact
On deployments running with WITH_API=true and no file binary present, an authenticated board member can upload HTML containing JavaScript labeled as image/png, bypass MIME validation, and execute active content under the Wekan origin when another user opens the file.

Affected Products

Wekan open source kanban application
All Wekan versions prior to 9.90
Deployments configured with WITH_API=true running on minimal container images without the file binary

Discovery Timeline

2026-08-19 - CVE CVE-2026-68899 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-68899

Vulnerability Analysis

Wekan validates uploaded attachments through isFileValid() in models/fileValidation.js. The function invokes detectMimeFromFile() to determine the true MIME type using the Unix file command against the uploaded content. When Wekan runs on minimal container images that omit the file binary, detectMimeFromFile() returns undefined without raising an error. The validation logic then falls back to fileObj.type, a client-controlled value transmitted via server/routes/attachmentApi.js. An attacker who is an authenticated board member can craft an HTML file containing JavaScript and set the type field to image/png in the API request. The dangerous MIME check treats the payload as a benign image and stores it as an attachment.

Root Cause

The root cause is insecure fallback behavior in file validation. detectMimeFromFile() silently returns undefined when its underlying dependency is missing, and downstream code trusts the client-supplied MIME type without independent content inspection. This violates defense in depth for uploaded content classified under [CWE-434].

Attack Vector

An authenticated user with board membership sends a crafted upload through the attachment API with a spoofed Content-Type header. When another user later views or opens the attachment, the browser renders the stored HTML as active content under the Wekan origin. The stored payload can steal session tokens, perform actions in the victim's context, and pivot within the Wekan application.

javascript

// Patch excerpt from models/fileValidation.js (v9.90)
// Source: https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263

// Dependency-free content sniff used as a fallback when the `file` binary is
// unavailable (GHSA-jhph-whx8-wq6p). It looks for definitive HTML / SVG / XML /
// script signatures so it does not misfire on a genuine binary upload.
export function looksLikeDangerousMarkup(text) {
  if (!text) return false;
  if (/<\s*(script|html|svg|iframe|object|embed|foreignobject|meta\b)/i.test(text)) return true;
  if (/^[\s\\uFEFF]*(<\?xml|<!doctype)/i.test(text)) return true;
  if (/<!entity/i.test(text)) return true;
  return false;
}

// Warn only once (per server process) that the `file` binary is unavailable.
let fileBinaryUnavailableWarned = false;

async function detectMimeFromFile(filePath) {
  if (!Meteor.isServer) return undefined;
  // ...
}

Detection Methods for CVE-2026-68899

Indicators of Compromise

Wekan attachments where the stored file magic bytes do not match the declared MIME type, especially images that begin with <html, <script, <svg, or <?xml.
Server logs showing repeated warnings that the file binary is unavailable on the Wekan host.
Attachment API requests to server/routes/attachmentApi.js with Content-Type: image/* but text-like payload sizes and content.

Detection Strategies

Audit stored attachments in the Wekan database for byte-content mismatches against the declared MIME type using signature-based scanning.
Monitor Wekan process logs for the fileBinaryUnavailableWarned warning introduced in v9.90, which indicates degraded MIME detection.
Inspect reverse proxy or WAF logs for authenticated POST requests to attachment endpoints containing HTML, SVG, or script markers in the body.

Monitoring Recommendations

Enable request body logging on the attachment API and alert on uploads whose declared type is image/* but whose body contains <script, <svg, or <iframe.
Track outbound requests from browsers accessing Wekan attachments for anomalous callbacks that indicate XSS execution.
Review board membership changes and correlate new members with subsequent attachment uploads.

How to Mitigate CVE-2026-68899

Immediate Actions Required

Upgrade Wekan to version 9.90 or later, which adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable.
Ensure the file binary is installed in the Wekan container or host image so content-based MIME detection functions as designed.
Review existing attachments for spoofed MIME types and remove any that contain executable markup.

Patch Information

The fix is included in Wekan v9.90. The patch introduces looksLikeDangerousMarkup() in models/fileValidation.js as a dependency-free fallback content sniff that detects HTML, SVG, XML, and script signatures. When the file binary is missing, this function forces the dangerous-content scan regardless of the client-supplied MIME type. See the GitHub Security Advisory GHSA-jhph-whx8-wq6p and the GitHub Release v9.90 for full details.

Workarounds

Install the file binary on the Wekan server so detectMimeFromFile() can perform content-based MIME detection instead of falling back to the client-supplied value.
Set WITH_API=false on deployments that do not require the public REST API to reduce exposure of the attachment upload endpoint.
Restrict board membership to trusted users until the upgrade to v9.90 is complete.

bash

# Verify the file binary is available on the Wekan host or container
which file && file --version

# Debian/Ubuntu-based container: install the file utility
apt-get update && apt-get install -y file

# Alpine-based container: install the file utility
apk add --no-cache file

# Disable the REST API if it is not required
export WITH_API=false