Read the docs
TI-2026-48307 Aliases CVE-2026-68560

Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its {file} placeholder and executed the result through asyncExec, which is promisify(exec) and invokes `/bin/sh -c`. On deployments with an external scanner configured, an authenticated user able to upload an attachment could place shell metacharacters such as command substitutions in the filename and execute commands as the Wekan server process. Version 9.75 adds shellQuote() and passes the file path as a POSIX single-quoted argument so shell metacharacters cannot escape the placeholder. This issue is fixed in version 9.75.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00584 48th percentileScored 2026-11-07
Fix Fixed wekan (wekan): 9.75

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wekanwekanbefore 9.759.75Patch availableCNA
  • wekan Vendorwekan Affected before 9.75 Fixed in 9.75 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*——wekan
  • cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* Versions — — ·wekan

Remediation

  • Fix · CNA wekan (wekan) Fixed in 9.75

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68560

References

Other 3

  • TI-2026-40177 Improper authentication in wekan CVSS 3.1CRITICAL 9.8
  • TI-2026-37989 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook CVSS 4.0CRITICAL 9.2
  • TI-2026-48308 Improper privilege management in wekan CVSS 3.1HIGH 8.8
  • TI-2026-48305 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) CVSS 3.1HIGH 8.5
  • TI-2026-39911 Improper access control in wekan CVSS 3.1HIGH 8.5
  • TI-2026-01855 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVSS 4.0MEDIUM 6.9
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences