An authenticated remote code execution risk exists in Wekan due to improper validation of uploaded file types, requiring an immediate software update.

The application is susceptible to unrestricted upload of files with dangerous types (CWE-434), allowing an authenticated user to bypass security controls and potentially achieve remote code execution.

Successful exploitation allows an authenticated attacker to upload and execute arbitrary files on the server, leading to full system compromise. While the CVSS score of 8.7 reflects a high risk, the requirement for user authentication slightly lowers the immediate accessibility for external attackers who have not yet compromised a user account.

Immediate Action: Upgrade Wekan to version 9.90 or later to ensure proper file type validation and security hardening.

Proactive Monitoring: Audit the file upload directory for unexpected executable files or anomalous file extensions that deviate from standard usage.

Compensating Controls: Implement strict server-side file type validation and store uploaded files in a directory configured with no-execute permissions.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the integrity of the Wekan platform. Administrators should prioritize upgrading to version 9.90 to close this upload vulnerability and review all current user accounts to ensure no unauthorized access has been used to exploit this flaw previously.