High · published December 15, 2025
⚡ An attacker can trick Wekan into serving harmful attachments, executing their HTML/JS like a magician pulling a rabbit out of a hat—except this rabbit steals your session tokens! 🔥 Imagine your kanban board is a restaurant, and an unauthorized cook slips a dangerous dish into the menu without anyone checking the recipe. Diners who order it unwittingly get served something that could leave them sick instead of satisfied! This vulnerability allows attackers to execute malicious code within your application, potentially stealing session tokens and executing Cross-Site Request Forgery (CSRF) attacks. If exploited, it could lead to unauthorized access or damaging actions on behalf of users without their consent—definitely a recipe for disaster!
Imagine your kanban board is a restaurant, and an unauthorized cook slips a dangerous dish into the menu without anyone checking the recipe. Diners who order it unwittingly get served something that could leave them sick instead of satisfied! This vulnerability in Wekan allows uploaded attachments to have an attacker-specified Content-Type, resulting in execution of malicious HTML/JS code in the application's origin, bypassing security measures. The attacker can take control of user sessions and perform CSRF actions.
This vulnerability allows attackers to execute malicious code within your application, potentially stealing session tokens and executing Cross-Site Request Forgery (CSRF) attacks. If exploited, it could lead to unauthorized access or damaging actions on behalf of users without their consent—definitely a recipe for disaster! Immediately upgrade Wekan to version 18.16 to close this vulnerability. Additionally, review your file upload and Content-Type validation processes to ensure no harmful content can slip through. Stay vigilant and conduct regular security audits! You've got this! Patch up, and your kanban board will be safe and sound in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wekan_project/wekan | < 8.16 | 8.16 |