An authenticated board member on a Wekan instance can upload a file that contains JavaScript but label it as image/png. The server normally validates the MIME type using the Unix file command, but when that binary is missing the validation falls back to the user‑supplied type. This allows malicious HTML content to be stored and executed when other users view the attachment, resulting in a stored cross‑site scripting vulnerability. The weakness originates from improper validation of the file’s MIME type (CWE‑434).

The flaw affects all installations of Wekan built with Meteor that use versions earlier than 9.90 and have the WITH_API option enabled while lacking the Unix file binary. The problem is resolved in release 9.90 and later, where the server performs byte‑level scanning when MIME detection cannot be performed.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS is not available, so the current exploit probability is uncertain, but the flaw is technically straightforward to exploit for any authenticated board member. The vulnerability is not listed in the CISA KEV catalog. In environments that have disabled the file binary and left the API enabled, the risk is elevated due to the absence of a fallback validation check.