CVE-2026-68899

CVE-2026-68899 is a stored XSS in Wekan's card attachment handler, but the real story is how the vulnerability emerged from a structural design flaw that treated security validation as an optional feature with graceful degradation — when the actual effect was silent failure that removed all content validation entirely. The core issue: Wekan's `detectMimeFromFile()` function returns `undefined` when the `file` binary is unavailable. That return value was treated as a signal to fall back to the untrusted `fileObj.type` field supplied by the client. This creates a defense-in-depth failure disguised as an availability feature — the system degrades for deployments that don't install the `file` binary, but does so by removing all MIME validation. The attack surface is gated by `WITH_API=true`, meaning this isn't a universal Wekan flaw; it manifests only in specific deployment configurations where the API is enabled and the binary is absent. This produces a dangerous asymmetry: a sysadmin running a minimal container to reduce attack surface inadvertently opened the vulnerability, while one who left the `file` binary in their image because it "came with the base image" got security for free without knowing why. The most security-conscious deployments were safe; the leanest ones were exposed. The patch in version 9.90 introduces `looksLikeDangerousMarkup()` as a byte-inspection fallback, which is the correct architectural approach — moving validation into the application layer rather than depending on an external binary. However, this introduces a new heuristic that must be maintained and understood by future maintainers. Heuristics fossilize just as quickly as binary dependencies: in three years, someone may refactor "looksLikeDangerousMarkup" as unnecessary and reintroduce the same vulnerability through a different mutation. What to check: Verify your Wekan deployment's `WITH_API` setting and whether the `file` binary is present in your container or environment. If you're running with the API enabled but without the binary, you're currently in the vulnerable state — the patch addresses this, but understanding your topology is essential for risk assessment. Audit any other security-critical logic that depends on optional external tools; those dependencies should either be enforced (fail hard if missing) or replaced with in-application validation.

Reviewed through automated stages and approved by a human before publication.