UploadBleed
| CVE | Icon | Vulnerability name | Date | Responsible Security Disclosure by | Stars | Process | Vulnerabilities |
|---|---|---|---|---|---|---|---|
| - | UploadBleed | 2026-10-27 | xet7 |  |
Found while checking whether attachments had the shape of StampBleed, the day it was found; fixed by xet7. |
Meteor-Files' upload pipeline stored attachments past the allow rules, and nothing checked who uploaded: anyone, signed in or not, could put a file on any card of any board. CWE-862; critical severity. No CVE assigned. Fix prepared locally for the Upcoming release; not yet released. |
Details
Attachments are uploaded through Meteor-Files' own DDP methods (_FilesCollectionStart_attachments, _FilesCollectionWrite_attachments) and their HTTP equivalent. When the last chunk arrives, the package inserts the stored document with a server-side insert, which never asks the collection's allow rules. The only hook it asks on the way, onBeforeUpload, cleaned the file name and returned true.
So any DDP client, signed in or not, could upload a file onto any card of any board by naming its ids in the upload's meta. The attachment was published to that board's members, shown on the card, and announced with an activity and its notifications. The administrator's switch that blocks uploads was checked only in the allow rule, and so was skipped as well. Avatars were not affected: their upload hook requires a signed-in user.
Fix: a server-side onBeforeUpload authorizes every chunk of an upload, after the shared file-name cleaning: the uploader is signed in; may edit the card - or, for a board's background or map image, write the board; uploads are not blocked; and a card attachment's board, list and swimlane are taken from its card, whatever the upload said.
Detection
A refused upload is recorded once per upload, at its start, as UploadBleed in Admin Panel / Problems (key authz.attachment-upload); a signed-in account that tries it is blocked, as for other critical attempts. Refusals a legitimate user can reach - uploads turned off by an administrator, a card or board deleted meanwhile - are not recorded.
Verification
tests/uploadBleed.test.cjs drives the upload decision: not signed in, a card one cannot edit, a board one cannot write, and a foreign board stamp are refused and recorded; WeKan's own uploads - card attachments, linked cards, board backgrounds and map images - are allowed and stamped from the card. A negative test fails on any FilesCollection whose upload is not checked on the server. A Playwright spec starts a refused upload on the running server; it has not been run yet.