Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments.js insert rule checks only board write access, and FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the stored path without a storage-root containment check, allowing arbitrary file reads and denial of service through special files such as /dev/zero. This issue is fixed in version 9.31.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-52890 Arbitrary File Read in Wekan Prior to Version 9.31 via Attachment Insert https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52890
Post summary
The text announces a CVE (CVE‑2026‑52890) detailing an arbitrary file read vulnerability in Wekan versions prior to 9.31 that can be triggered via attachment insertion; no exploitation or patch details are provided.