CVE-2026-52891: Wekan shell command injection in avatar upload

CVE-2026-52891 · Severity: critical · CVSS 9.9 · Published 2026-07-15

Wekan, an open-source project management tool, contains a critical security flaw in its user profile picture (avatar) upload feature. An attacker with a standard user account can upload a specially crafted file that forces the server to execute malicious commands. This could lead to a complete takeover of the server, allowing the attacker to steal sensitive project data, delete information, or use the server to launch further attacks.

Technologies: WeKan. Vendors: WeKan.

Quick answers

Is CVE-2026-52891 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52891 being exploited in the wild.
How severe is CVE-2026-52891?
Critical severity, with a CVSS score of 9.9, published 15 July 2026.
Which products and versions are affected?
WeKan < 9.07.
Is there a fix for CVE-2026-52891?
A patch was published on 2026-05-03: Version 9.07 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52891 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52891?
Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in Wekan's avatar upload process within 'models/avatars.js' and 'models/fileValidation.js'. The application uses 'child_process.exec()' to run the 'file' command for MIME-type detection, embedding the user-provided filename directly into the command string. Because the filename is not sanitized for shell metacharacters, an authenticated attacker can use backticks or POSIX command substitution (e.g., $(whoami)) in a filename to execute arbitrary code with the privileges of the Wekan server process. This issue was previously patched for general attachments but remained in the avatar upload path until version 9.07.

Affected products

  • Wekan Wekan < 9.07

Timeline

  • 2026-05-03: patched: Version 9.07 released to address the vulnerability.
  • 2026-05-30: advisory: GitHub Security Advisory GHSA-35j7-h385-2q9g published.
  • 2026-07-15: disclosed: CVE-2026-52891 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.