Read the docs
TI-2026-23673 Aliases CVE-2026-30844

Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

Priority MEDIUM 42CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachment URLs from user-supplied JSON data are fetched directly by the server without any URL validation or filtering, affecting both the Wekan and Trello import flows. The parseActivities() and parseActions() methods extract user-controlled attachment URLs, which are then passed directly to Attachments.load() for download with no sanitization. This Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to make the server issue arbitrary HTTP requests, potentially accessing internal network services such as cloud instance metadata endpoints (exposing IAM credentials), internal databases, and admin panels that are otherwise unreachable from outside the network. This issue has been fixed in version 8.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00268 19th percentileScored 2026-11-07
Fix Fixed Wekan (Wekan): 8.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wekanWekan8.32 to before 8.348.34Patch availableCNA
  • Wekan Vendorwekan Affected 8.32 to before 8.34 Fixed in 8.34 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:wekan_project:wekan:8.32:*:*:*:*:*:*:*8.32Vulnerablewekan
cpe:2.3:a:wekan_project:wekan:8.33:*:*:*:*:*:*:*8.33Vulnerablewekan
  • cpe:2.3:a:wekan_project:wekan:8.32:*:*:*:*:*:*:* Versions 8.32 Vulnerable ·wekan
  • cpe:2.3:a:wekan_project:wekan:8.33:*:*:*:*:*:*:* Versions 8.33 Vulnerable ·wekan

Remediation

  • Fix · CNA Wekan (Wekan) Fixed in 8.34

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30844

References

Patch 1

Advisory 1

Other 1

  • TI-2026-01855 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2023-13025 A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before… CVSS 3.1MEDIUM 5.4
  • TI-2026-20667 WeKan < 8.19 LDAP Authentication Filter Injection CVSS 4.0HIGH 8.7
  • TI-2026-23675 Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication CVSS 4.0HIGH 8.7
  • TI-2026-23672 Wekan has Cross-Board IDOR in Custom Fields Update Endpoints CVSS 4.0CRITICAL 9.3
  • TI-2025-40439 An issue was discovered in Wekan The Open Source kanban board system up to version 18.15… CVSS 3.1HIGH 8.2
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences