CVE-2026-68560

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its {file} placeholder and executed the result through asyncExec, which is promisify(exec) and invokes `/bin/sh -c`. On deployments with an external scanner configured, an authenticated user able to upload an attachment could place shell metacharacters such as command substitutions in the filename and execute commands as the Wekan server process. Version 9.75 adds shellQuote() and passes the file path as a POSIX single-quoted argument so shell metacharacters cannot escape the placeholder. This issue is fixed in version 9.75.

• CWE-78

• https://github.com/wekan/wekan/commit/1a222c4477e68c76fd6a866954b535fba0a78d05
• https://github.com/wekan/wekan/releases/tag/v9.75
• https://github.com/wekan/wekan/security/advisories/GHSA-x3xm-pxrv-jg7p

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68552Coturn is a free open source implementation of TURN and STUN…5.3
• CVE-2026-68553Coturn is a free open source implementation of TURN and STUN…7.1
• CVE-2026-68554Coturn is a free open source implementation of TURN and STUN…2.3
• CVE-2026-68555Coturn is a free open source implementation of TURN and STUN…6.5
• CVE-2026-68558Wekan is open source kanban built with Meteor. From 8.36 unt…8.5
• CVE-2026-68559Wekan is open source kanban built with Meteor. From 9.57 unt…6.5
• CVE-2026-68561Wekan is open source kanban built with Meteor. Prior to 9.89…8.8
• CVE-2026-68562A flaw was found in ansible-collection-redhat-leapp. An atta…6.2
• CVE-2026-68563A flaw was found in ansible-collection-redhat-leapp. When a …5.5
• CVE-2026-68564Unauthenticated Cross Site Scripting (XSS) in NotificationX …7.1
• CVE-2026-68565Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.…6.5
• CVE-2026-68566Unauthenticated SQL Injection in BookingPress Appointment Bo…9.3