CyberRota Analysis
AI-GeneratedWekan versions prior to 9.90 are vulnerable due to improper MIME type validation, allowing authenticated users to upload malicious HTML files disguised as image files, which can execute JavaScript when accessed by other users. This vulnerability poses a significant risk of cross-site scripting (XSS) attacks, potentially compromising user data and application integrity. Organizations using Wekan with API enabled should prioritize upgrading to version 9.90 or later to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.