CVE-2026-52890

🗓️ 15 Jul 2026 21:07:16Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 20 Views🌐 WEB

Before 9.31, a logged-in board member could abuse attachments.insert to read arbitrary files via a path and cause DoS.

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-52890	15 Jul 202621:07	–	attackerkb
Cvelist	CVE-2026-52890 Wekan: Arbitrary file read and server DoS via attachment versions.original.path	15 Jul 202621:07	–	cvelist
EUVD	EUVD-2026-44828	15 Jul 202621:07	–	euvd
NVD	CVE-2026-52890	15 Jul 202622:17	–	nvd
Positive Technologies	PT-2026-60316	15 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-52890 Wekan: Arbitrary file read and server DoS via attachment versions.original.path	15 Jul 202621:07	–	vulnrichment

Vulners

Node

wekan_project wekanRange<9.31

[
  {
    "vendor": "wekan",
    "product": "wekan",
    "versions": [
      {
        "version": "< 9.31",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/wekan/wekan/commit/fc92b342ceedcf38dbd614a0f7b50d6dc2b22eb8
github	www.github.com/wekan/wekan/releases/tag/v9.31
github	www.github.com/wekan/wekan/security/advisories/GHSA-g6vm-7757-pr88

Parameter	Position	Path	Description	CWE
versions.original.path	request body	attachments/insert	Vulnerability in Wekan allows arbitrary file reads via attacker-controlled versions.original.path and versions.original.storage in the attachments/insert DDP method (pre-9.31), leading to server-side file read/DoS.	CWE-400, CWE-22
versions.original.storage	request body	attachments/insert	Vulnerability in Wekan allows arbitrary file reads via attacker-controlled versions.original.path and versions.original.storage in the attachments/insert DDP method (pre-9.31), leading to server-side file read/DoS.	CWE-400, CWE-22

16 Jul 2026 14:16Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.17.1

EPSS0.00325

SSVC