v9.75 2026-07-05 WeKan ® release

This release fixes the following CRITICAL SECURITY ISSUE of ScannerBleed:

• ScannerBleed: shell injection (RCE) via a malicious upload filename in the external antivirus scanner command path (GHSA-x3xm-pxrv-jg7p, CWE-78 OS Command Injection). Same RCE class as AvatarBleed (CVE-2026-52891, GHSA-35j7-h385-2q9g) and its follow-up regression (CVE-2026-53447 / GHSA-qfqv-42qw-vvwh area), but in a code path that was never covered by those fixes. In models/fileValidation.js, when an admin has configured an external scanner (antivirus) command line with a {file} placeholder, the uploaded file path was interpolated into the command and run through asyncExec (promisify(exec)), which spawns /bin/sh -c and interprets all shell metacharacters:

  await asyncExec(externalCommandLine.replace("{file}", '"' + fileObj.path + '"'));

  Wrapping the path in double quotes is not a shell boundary — inside double quotes the shell still expands $(...), backticks and \, so a filename such as a`id`.png or $(touch /tmp/pwn).png escaped the argument and executed as the Wekan server process. Any authenticated user who can upload an attachment could trigger it, on servers that have an external scanner configured. Unlike the sibling MIME-detection path (detectMimeFromFile, which already uses execFile with no shell) and unlike the AvatarBleed fix (which strips non-alphanumeric characters from the filename), this scanner path had zero sanitization.
  • Fixed by POSIX single-quote-escaping the interpolated file path via a new shellQuote() helper (wrap in single quotes, escape embedded ' as '\''). Inside single quotes the shell interprets no metacharacters, so a malicious filename can no longer break out of the argument or inject commands, while the admin’s arbitrary command line and the exact on-disk path are both preserved. CVSS:3.1 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
  • Affected Wekan v9.06 and earlier through the current release; fixed at the upcoming WeKan release. Reported by DavidCarliez. Thanks to DavidCarliez and xet7!