CVE-2026-68899

{
  "id": "CVE-2026-68899",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T20:17:21.567",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90."
    },
    {
      "lang": "es",
      "value": "Wekan es un kanban de código abierto construido con Meteor. Antes de la versión 9.90, isFileValid() en models/fileValidation.js usaba el comando file de Unix para la detección de MIME basada en contenido, pero detectMimeFromFile() devolvía undefined silenciosamente cuando ese binario no estaba disponible y la validación recurría al fileObj.type controlado por el atacante, suministrado a través de server/routes/attachmentApi.js. En implementaciones con WITH_API=true y sin el binario file, un miembro de la junta autenticado podía etiquetar HTML que contenía JavaScript como image/png, eludir la peligrosa verificación MIME y almacenar contenido activo bajo el origen de Wekan para su ejecución cuando otro usuario lo abriera. La versión 9.90 añade looksLikeDangerousMarkup() para inspeccionar los bytes del archivo y forzar el escaneo de contenido peligroso cuando la detección de MIME no está disponible. Este problema está solucionado en la versión 9.90."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "wekan",
          "product": "wekan",
          "versions": [
            {
              "version": "< 9.90",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T21:00:36.236408Z",
          "id": "CVE-2026-68899",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wekan/wekan/releases/tag/v9.90",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p",
      "source": "[email protected]"
    }
  ]
}