CVE-2026-52890 Wekan: Arbitrary file read and server DoS via attachment versions.original.path
A logged-in user can read arbitrary files or cause denial of service by manipulating attachment paths in Wekan.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-52890?
CVE-2026-52890 is a high-severity path traversal vulnerability in wekan, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.
Which versions are affected by CVE-2026-52890?
How do I fix CVE-2026-52890?
No fix has been published for CVE-2026-52890 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-52890 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52890 exists.
Sources
Also known as GHSA-g6vm-7757-pr88.