CVE-2026-52890

Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments....

PT-2026-60316

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.31 Description A logged-in board member can perform arbitrary file reads and cause a denial of service by inserting an attachment document through the '/attachments/insert' DDP method. The issue occurs because the...