Hall of Fame image from https://openclipart.org/detail/120343/trophy
Back to Hall of Fame Contents Back to Wekan Website

Contents / LiveBleed

CVE Vulnerability name Date Responsible Security Disclosure by Vulnerabilities
-

LiveBleed

2026-07-19 meifukun (GitHub) and xet7 (fix)

Privately reported 8 issues reviewed against WeKan v9.95.0.
  • LiveBleed — the live Trello import (server/trelloApiImport.js) downloaded attacker-controlled Trello attachment / background / avatar URLs with bare fetch() — no SSRF guard, unlike the offline path — and stored the response as an imported attachment readable back through the attachment API, giving NON-BLIND SSRF (cloud metadata / internal services). Fixed by gating every live-import download with validateAttachmentUrl(), matching the offline import (CWE-918 Server-Side Request Forgery)
  • Reported privately by meifukun (https://github.com/meifukun)
  • Fixed at upcoming WeKan release
  • More details


Details

LiveBleed — CWE-918 Server-Side Request Forgery

the live Trello import (server/trelloApiImport.js) downloaded attacker-controlled Trello attachment / background / avatar URLs with bare fetch() — no SSRF guard, unlike the offline path — and stored the response as an imported attachment readable back through the attachment API, giving NON-BLIND SSRF (cloud metadata / internal services). Fixed by gating every live-import download with validateAttachmentUrl(), matching the offline import.

Reported privately by meifukun (https://github.com/meifukun), who reviewed 8 issues against WeKan v9.95.0 (commit f602b9459fa1622f60ee8c3b639f02035f3ab32b) on local self-hosted instances only. Fixed at the upcoming WeKan release.