CVE-2026-52891

creationtimestamp| type| source ---|---|--- 2026-07-15 22:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqpq5spsbr25 2026-07-16 00:30:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyal2izp2s 2026-07-18 04:18:04+00:00| seen|...

CVE-2026-52891

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to childprocess.exec for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename...