Executive brief
Wekan, an open-source project management tool, contains a critical security flaw in its user profile picture (avatar) upload feature. An attacker with a standard user account can upload a specially crafted file that forces the server to execute malicious commands. This could lead to a complete takeover of the server, allowing the attacker to steal sensitive project data, delete information, or use the server to launch further attacks.
Technical details
An OS command injection vulnerability exists in Wekan's avatar upload process within 'models/avatars.js' and 'models/fileValidation.js'. The application uses 'child_process.exec()' to run the 'file' command for MIME-type detection, embedding the user-provided filename directly into the command string. Because the filename is not sanitized for shell metacharacters, an authenticated attacker can use backticks or POSIX command substitution (e.g., $(whoami)) in a filename to execute arbitrary code with the privileges of the Wekan server process. This issue was previously patched for general attachments but remained in the avatar upload path until version 9.07.
Affected products
- Wekan Wekan < 9.07
Timeline
- 2026-05-03: patched: Version 9.07 released to address the vulnerability.
- 2026-05-30: advisory: GitHub Security Advisory GHSA-35j7-h385-2q9g published.
- 2026-07-15: disclosed: CVE-2026-52891 published to the NVD.