{"api_version":"1","generated_at":"2026-08-22T16:05:18+00:00","cve":"CVE-2026-68899","urls":{"html":"https://cve.report/CVE-2026-68899","api":"https://cve.report/api/cve/CVE-2026-68899.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68899","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68899"},"summary":{"title":"Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback","description":"Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-08-19 20:17:21","updated_at":"2026-08-21 22:16:43"},"problem_types":["CWE-434","CWE-434 CWE-434: Unrestricted Upload of File with Dangerous Type"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"8.7","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.7","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p","name":"https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263","name":"https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/wekan/wekan/releases/tag/v9.90","name":"https://github.com/wekan/wekan/releases/tag/v9.90","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68899","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68899","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"wekan","product":"wekan","version":"affected < 9.90","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68899","cve":"CVE-2026-68899","epss":"0.004030000","percentile":"0.338710000","score_date":"2026-08-21","updated_at":"2026-08-22 00:12:48"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-68899","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-21T21:00:36.236408Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-21T21:49:01.859Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"wekan","vendor":"wekan","versions":[{"status":"affected","version":"< 9.90"}]}],"descriptions":[{"lang":"en","value":"Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434: Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-19T19:26:06.041Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p","tags":["x_refsource_CONFIRM"],"url":"https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p"},{"name":"https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263","tags":["x_refsource_MISC"],"url":"https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263"},{"name":"https://github.com/wekan/wekan/releases/tag/v9.90","tags":["x_refsource_MISC"],"url":"https://github.com/wekan/wekan/releases/tag/v9.90"}],"source":{"advisory":"GHSA-jhph-whx8-wq6p","discovery":"UNKNOWN"},"title":"Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-68899","datePublished":"2026-08-19T19:26:06.041Z","dateReserved":"2026-07-31T21:04:04.039Z","dateUpdated":"2026-08-21T21:49:01.859Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-19 20:17:21","lastModifiedDate":"2026-08-21 22:16:43","problem_types":["CWE-434","CWE-434 CWE-434: Unrestricted Upload of File with Dangerous Type"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-21T21:00:36.236408Z","id":"CVE-2026-68899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68899","Ordinal":"1","Title":"Wekan: File Upload MIME Type Validation Bypass — Stored XSS via ","CVE":"CVE-2026-68899","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68899","Ordinal":"1","NoteData":"Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.","Type":"Description","Title":"Wekan: File Upload MIME Type Validation Bypass — Stored XSS via "}]}}}