The CVSS 7.7 score on this CVE materially understates the actual risk in typical deployments. The vulnerability scores as 'authenticated RCE' because the attack requires a valid user account — but Wekan is a team collaboration tool where onboarding all employees is the entire point of deployment. The authentication gate isn't enforcing a security boundary; it's enforcing an organizational formality. For insider threat models, any employee receives this primitive on day one, which transforms the vulnerability from 'remote outsider must compromise an account' to 'any employee or compromised credential gets code execution on the file-processing host.'
The technical mechanism is straightforward: administrators configure an external antivirus scanner using the externalCommandLine setting with a {file} placeholder. The code takes the uploaded file's path, interpolates it directly into the shell command template, and passes the result to asyncExec, which invokes /bin/sh -c. A filename like $(whoami).txt in an uploaded attachment executes arbitrary commands. The 9.75 fix wraps the interpolated path in POSIX single quotes, preventing metacharacter injection because single-quoted strings carry no special interpretation in shells.
One caveat: the single-quote fix handles metacharacters but may not handle filenames containing literal single quotes. A filename with an embedded single quote could potentially terminate the quoted context and resume shell interpretation. Whether shellQuote() or equivalent sanitizes embedded quotes (typically via the '+'+' escape pattern) determines whether this is a complete fix or a PoC-level patch.
The unresolved question that determines real-world severity: does the external scanner feature default to enabled or disabled in Wekan 9.74? If it's a common production configuration because organizations want antivirus scanning on uploads, this is a mass vulnerability. If it's disabled by default and rarely enabled, it's a narrow, admin-dependent issue. This deployment-default question is the critical factor the CVSS score doesn't capture but that defenders must answer for their environment.