CVE-2026-68560

creationtimestamp| type| source ---|---|--- 2026-08-22 13:20:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtoei7mnyn2e...

CVE-2026-68560

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...