Wekan: Arbitrary file read and server DoS via attachment versions.original.path

Description

Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.

Scores

EPSS (exploitation in 30 days)

0.48% · top 59% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs
• CWE-400: Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs

Affected products

• wekan · wekan

  • affected < 9.31

References (3)

• https://github.com/wekan/wekan/security/advisories/GHSA-g6vm-7757-pr88 (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/wekan/wekan/commit/fc92b342ceedcf38dbd614a0f7b50d6dc2b22eb8 (opens in a new tab)x_refsource_MISC
• https://github.com/wekan/wekan/releases/tag/v9.31 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-52890](https://trackcve.app/badge/CVE-2026-52890.svg)](https://trackcve.app/cve/CVE-2026-52890)

Record last updated 16 Jul 2026, 12:59 UTC.