The vulnerability is a command injection flaw caused by assembling the external antivirus scanner command line with a user‑controlled file path that is not properly quoted. Since asyncExec ultimately runs /bin/sh -c, a malicious filename that contains shell metacharacters can modify the command line and allow an authenticated attacker with upload privileges to execute arbitrary commands as the Wekan process. This flaw compromises confidentiality, integrity, and availability of the affected host and is classified as CWE-78.

Wekan is an open‑source kanban board built on the Meteor framework, maintained by the wekan organization. Versions older than 9.75 are affected. Deployments that have the administrator‑configured externalCommandLine for a virus scanner enabled are at risk because the command line uses the unescaped {file} placeholder, allowing the attacker‑controlled filename to be injected.

The CVSS base score of 7.7 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation yet. The likely attack vector is an authenticated user who can upload a file and craft its name to include shell metacharacters; this enables execution of arbitrary code under the Wekan service account. Disabling or removing the externalCommandLine configuration eliminates the immediate attack surface.