You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Document AvatarMimeBleed, LegacyAttachBleed and SwimlaneBleed while preserving the earlier, distinct AvatarBleed record.
Thanks to crypto-nidh and xet7 !
<html><head><metacharset="UTF-8"><title>WeKan — Hall of Fame / AvatarMimeBleed</title><linkrel="stylesheet" type="text/css" href="../../css/main.css"></head>
2
+
<body><imgsrc="../hof.svg" alt="Hall of Fame trophy" width="300px" height="auto" />
3
+
<divclass="action-buttons"><aclass="button" href="https://wekan.fi/hall-of-fame">Back to Hall of Fame Contents</a></div>
<h2>Stored active content through avatar MIME metadata</h2>
6
+
<p><ahref="https://github.com/wekan/wekan/security/advisories/GHSA-4mjm-vj9f-p629">GHSA-4mjm-vj9f-p629</a> was reported by <ahref="https://github.com/crypto-nidh">crypto-nidh</a>.</p>
7
+
<p>Current and CollectionFS-compatible avatar routes trusted the stored MIME type, allowing browser-executable content to be served under the WeKan origin.</p>
8
+
<p><b>Fix:</b> a shared response policy converts HTML, XML, SVG and JavaScript MIME types to sandboxed opaque downloads with nosniff and frame denial. Safe image types remain inline. No Problems event is emitted because legitimate avatar views use this same path and cannot identify who supplied old metadata. Fixed for the upcoming WeKan v11.21 release on 2026-08-28.</p>
<tdclass="by" valign="top"><b><ahref="https://github.com/crypto-nidh">crypto-nidh</a></b> and <b><ahref="https://github.com/xet7">xet7</a></b></td>
Coordinated disclosure through a GitHub security advisory, reproduced against both current and legacy avatar routes.
100
+
</details>
101
+
</td>
102
+
<tdvalign="top">
103
+
<details>
104
+
<summary>Details</summary>
105
+
106
+
<ul><li>Stored browser-executable avatar MIME types could render active content under the WeKan origin (CWE-79, CWE-434)</li><li>Dangerous types are now sandboxed opaque downloads with nosniff and frame denial</li><li>No Problems event is emitted because legitimate avatar views use the same response path</li><li><ahref="avatarmimebleed/">More details</a></li></ul>
<tdclass="by" valign="top"><b><ahref="https://github.com/crypto-nidh">crypto-nidh</a></b> and <b><ahref="https://github.com/xet7">xet7</a></b></td>
Coordinated disclosure through a GitHub security advisory, reproduced against the CollectionFS-compatible attachment route.
122
+
</details>
123
+
</td>
124
+
<tdvalign="top">
125
+
<details>
126
+
<summary>Details</summary>
127
+
128
+
<ul><li>Legacy HTML, XML and JavaScript attachments lacked the protections already applied to SVG files (CWE-79, CWE-693)</li><li>All browser-executable types now receive the same opaque, sandboxed download policy</li><li>No Problems event is emitted because legitimate legacy downloads use the same response path</li><li><ahref="legacyattachbleed/">More details</a></li></ul>
<tdclass="by" valign="top"><b><ahref="https://github.com/crypto-nidh">crypto-nidh</a></b> and <b><ahref="https://github.com/xet7">xet7</a></b></td>
Coordinated disclosure through a GitHub security advisory, reproduced with a read-only board member calling the Meteor method directly.
144
+
</details>
145
+
</td>
146
+
<tdvalign="top">
147
+
<details>
148
+
<summary>Details</summary>
149
+
150
+
<ul><li>Read-only members could create a default swimlane through a method guarded only by read membership (CWE-862)</li><li>The method now requires the shared board write capability</li><li>Denied attempts are summarized in Admin Panel → Problems</li><li><ahref="swimlanebleed/">More details</a></li></ul>
<html><head><metacharset="UTF-8"><title>WeKan — Hall of Fame / LegacyAttachBleed</title><linkrel="stylesheet" type="text/css" href="../../css/main.css"></head>
2
+
<body><imgsrc="../hof.svg" alt="Hall of Fame trophy" width="300px" height="auto" />
3
+
<divclass="action-buttons"><aclass="button" href="https://wekan.fi/hall-of-fame">Back to Hall of Fame Contents</a></div>
<h2>Stored active content through legacy attachment MIME metadata</h2>
6
+
<p><ahref="https://github.com/wekan/wekan/security/advisories/GHSA-xcxp-hx9w-q5q9">GHSA-xcxp-hx9w-q5q9</a> was reported by <ahref="https://github.com/crypto-nidh">crypto-nidh</a>.</p>
7
+
<p>The CollectionFS-compatible attachment route protected SVG files but served other browser-executable MIME types without the same CSP, nosniff and frame restrictions.</p>
8
+
<p><b>Fix:</b> HTML, XML, SVG and JavaScript types now share one sandboxed opaque-download policy. No Problems event is emitted because legitimate legacy downloads use the same path and cannot attribute dangerous old metadata to the current viewer. Fixed for the upcoming WeKan v11.21 release on 2026-08-28.</p>
<html><head><metacharset="UTF-8"><title>WeKan — Hall of Fame / SwimlaneBleed</title><linkrel="stylesheet" type="text/css" href="../../css/main.css"></head>
2
+
<body><imgsrc="../hof.svg" alt="Hall of Fame trophy" width="300px" height="auto" />
3
+
<divclass="action-buttons"><aclass="button" href="https://wekan.fi/hall-of-fame">Back to Hall of Fame Contents</a></div>
<p><ahref="https://github.com/wekan/wekan/security/advisories/GHSA-2x89-6mq2-834r">GHSA-2x89-6mq2-834r</a> was reported by <ahref="https://github.com/crypto-nidh">crypto-nidh</a>.</p>
7
+
<p>The default-swimlane Meteor method checked only board membership before inserting a structural object, so read-only roles could bypass the collection write rules.</p>
8
+
<p><b>Fix:</b> the method now requires the shared board write capability before insertion. Rejected attempts are bounded and summarized as SwimlaneBleed in Admin Panel → Problems. Fixed for the upcoming WeKan v11.21 release on 2026-08-28.</p>
0 commit comments