---
id: CVE-2026-68899
title: Wekan is open source kanban built with Meteor
summary: >-
  Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in
  models/fileValidation.js used the Unix file command for content-based MIME
  detection, but detectMimeFromFile() silently returned undefined when that
  binary wa…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-434
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68899'
references:
  - url: >-
      https://github.com/wekan/wekan/commit/f6ba472f6738bcd3763f133d3d9970f216df2263
    label: security-advisories@github.com
  - url: 'https://github.com/wekan/wekan/releases/tag/v9.90'
    label: security-advisories@github.com
  - url: 'https://github.com/wekan/wekan/security/advisories/GHSA-jhph-whx8-wq6p'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00403
epssPercentile: 0.34435
ingestedAt: '2026-09-09T21:22:45.543Z'
---

## Overview

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile() silently returned undefined when that binary was unavailable and the validation fell back to the attacker-controlled fileObj.type supplied through server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authenticated board member could label HTML containing JavaScript as image/png, bypass the dangerous MIME check, and store active content under the Wekan origin for execution when another user opened it. Version 9.90 adds looksLikeDangerousMarkup() to inspect file bytes and force dangerous-content scanning when MIME detection is unavailable. This issue is fixed in version 9.90.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.