What is CVE-2026-68560?
CVE-2026-68560 is a critical vulnerability in the Wekan open-source kanban application. Prior to version 9.75, the `models/fileValidation.js` interpolates uploaded file paths directly into an `externalCommandLine` and executes it via `/bin/sh -c`, leading to command injection. It is critical to immediately update Wekan to the latest version.
Azərbaycanca: CVE-2026-68560, Wekan açıq mənbəli kanban tətbiqində aşkarlanmış kritik boşluqdur. 9.75 versiyasından əvvəlki versiyalarda, `models/fileValidation.js` faylı yüklənən fayl yolunu birbaşa `externalCommandLine` əmrinə daxil edərək komanda inyeksiyasına yol açır. Təcili olaraq Wekan-i ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-78
FAQ2
Which versions of Wekan are affected by the CVE-2026-68560 vulnerability?
This vulnerability affects all versions of Wekan prior to version 9.75. It is recommended to update the application to the latest version for security.
What is the technical cause of the CVE-2026-68560 vulnerability?
The vulnerability is a command injection flaw caused by `models/fileValidation.js` interpolating uploaded file paths directly into an `externalCommandLine` and executing it via `/bin/sh -c`.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.