Hall of Fame image from https://openclipart.org/detail/120343/trophy
Back to Hall of Fame Contents Back to Wekan Website

Contents / FloppyBleed

CVE Vulnerability name Date Responsible Security Disclosure by Vulnerabilities
-

FloppyBleed

2026-01-24 18:30 EET Luke Hebenstreit of Twitter lheben_

Did send detailed report!


Timeline Details
2026-01-24 18:30 EET Report received.
2026-01-28 22:00 EET Fixed at Wekan v8.25 2026-01-28


Back to Hall of Fame Contents Back to Wekan Website

Follow-up fix, 2026-10-27

Found in the regression audit of every Hall of Fame vulnerability; fixed by xet7. The fs-path-heal upgrade step joined an attachment's stored name into candidate file paths as-is, so a record a client inserted named ../../../etc/passwd made the next upgrade copy that file into storage - an arbitrary file read. Only the name's last path component is used now, and the bulk move limits a legacy name's extension the same way.

Source fix and regression coverage