CyberRota Analysis
AI-GeneratedThe Wekan kanban application prior to version 9.07 is vulnerable due to improper handling of user-supplied filenames in the avatar upload functionality, which allows for command injection via shell metacharacters. This critical vulnerability can lead to remote code execution on the server, posing significant risks to the integrity and confidentiality of the system. Organizations using affected versions of Wekan should prioritize upgrading to version 9.07 or later to mitigate this severe security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.exec() for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename, shell metacharacters such as backticks and $() in the filename could execute commands on the server. This issue is fixed in version 9.07.