| CVE | Vulnerability name | Date | Responsible Security Disclosure by | Vulnerabilities |
|---|---|---|---|---|
|
-
|
RedirectBleed |
2026-07-19 |
meifukun (GitHub) and xet7 (fix) Privately reported 8 issues reviewed against WeKan v9.95.0. |
|
avatar localization (server/lib/localizeAvatar.js) validated only the ORIGINAL URL host with assertSafePublicUrl and then fetched with native fetch(url, {redirect:'follow'}), so an authenticated user could set profile.avatarUrl to a public redirector that 302s to 127.0.0.1, a private network, or 169.254.169.254 and the WeKan server followed it (SSRF). Fixed by fetching through the DNS-pinned, redirect-rejecting fetchSafe and scheme-validating profile.avatarUrl at write time.
Reported privately by meifukun (https://github.com/meifukun),
who reviewed 8 issues against WeKan v9.95.0 (commit
f602b9459fa1622f60ee8c3b639f02035f3ab32b) on local self-hosted instances only.
Fixed at the
upcoming WeKan release.