Technical impact
Wekan, an open‑source kanban board built on Meteor, is vulnerable because a logged‑in board member can use the /attachments/insert DDP method to supply attacker‑controlled versions.original.path and versions.original.storage values. The server/permissions/attachments.js insert rule only verifies that the user has board‑write rights, while FileStoreStrategyFilesystem.getReadStream() in models/lib/fileStoreStrategy.js streams the specified path without enforcing a storage-root containment check. Consequently, an authenticated attacker can read arbitrary files from the server and trigger denial of service by referencing special files such as /dev/zero. The flaw is resolved in Wekan 9.31, which introduces the missing containment check.
Affected Systems
The vulnerability impacts all deployments of Wekan running a version older than 9.31. Users must check that their instance is upgraded to at least 9.31, which contains the fix that adds a proper containment check when reading files.
Risk and Exploitability
The CVSS score of 7.1 indicates a high level of severity, while a very low but not zero probability of exploitation in the wild. The flaw requires only board‑write access, a privilege commonly granted to contributors, so an attacker with authenticated credentials or compromised board credentials can exploit it. The vulnerability is not listed in the CISA KEV catalog, but the combination of data exposure and potential denial of service warrants immediate mitigation.
