A critical vulnerability in Wekan allows unauthenticated attackers to execute malicious scripts in the application origin via manipulated file attachments, risking full account compromise.

The application fails to properly validate the Content-Type of uploaded attachments, allowing an attacker to force the server to serve files as text/html. This permits the execution of arbitrary JavaScript within the application's origin, which can be leveraged to steal session tokens or perform unauthorized actions on behalf of users.

This vulnerability poses a significant risk to organizational security, as it allows for the theft of administrative or user session tokens. With a CVSS score of 8.1, the high-severity rating reflects the potential for complete account takeover and the ability to perform cross-site request forgery (CSRF) actions, which could lead to unauthorized data access or disruption of project management workflows.

Immediate Action: Upgrade your Wekan installation to version 18.16 or later immediately to apply the necessary file validation security patches.

Proactive Monitoring: Review web server access logs for anomalous requests related to file uploads or unusual patterns in Content-Type headers for served attachments.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to inspect and block suspicious file upload attempts.

Public Exploit Available: No (exploit_available: unknown)

The ability to inject arbitrary HTML and JavaScript into the application environment presents a severe risk to data integrity and user privacy. Administrators must prioritize updating to version 18.16 as soon as possible to remediate this flaw and prevent potential session hijacking.