What is CVE-2026-68899?
CVE-2026-68899 affects the open-source Wekan Kanban application. Prior to version 9.90, the `isFileValid()` function relied on the Unix `file` command for MIME type detection, but when the binary is unavailable, `detectMimeFromFile()` silently returns `undefined`, causing validation to fall back and become bypassable. Users should upgrade to version 9.90 or later.
Azərbaycanca: CVE-2026-68899 Wekan açıq mənbə Kanban tətbiqinə təsir edir. 9.90 versiyasından əvvəl `isFileValid()` funksiyası MIME tipini yoxlamaq üçün Unix `file` əmrini istifadə edir, lakin bu əmr mövcud olmadıqda funksiya `undefined` qaytarır və yoxlama zəif qalır. Tətbiqi 9.90 və ya daha yeni versiyaya yeniləmək tövsiyə olunur.
FAQ2
How does CVE-2026-68899 impact the Wekan application?
The vulnerability involves the `isFileValid()` function using the Unix `file` command for MIME type validation. If the `file` binary is not available, the function returns `undefined`, causing the file validation to weaken and become bypassable.
What measure should be taken to protect against CVE-2026-68899?
Users should upgrade the Wekan application to version 9.90 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.