CVE-2026-114374
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the fetch-metadata Endpoint component. Such manipulation leads to server-side request forgery. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
An attacker could force the server to make requests to internal resources, potentially leading to data disclosure or further attacks.
Recommendation
Update wiki-go to version 1.9.2 or later. Restrict network access to internal resources from the application server.
Other vulnerabilities in wiki-go
See all- CVE-2026-114377Low
In leomoon-studios wiki-go up to 1.9.1, the DeleteComment function in internal/comments/comments.go (Comment Deletion Handler) is vulnerable to path traversal via manipulation of the documentPath argument. The attack may be initiated remotely and the exploit has been publicly disclosed. Upgrading to version 1.9.2 (patch commit 224ef2a11facddef6b3a3c1f0a69156d1e574a33) resolves the issue.
- CVE-2026-114376Medium
In leomoon-studios wiki-go up to 1.9.1, the SaveHandler/SourceHandler functions in internal/handlers/editor.go (API component) are vulnerable to path traversal via input manipulation. The attack can be launched remotely, and a public exploit may be used in attacks.
- CVE-2026-114375Medium
In leomoon-studios wiki-go up to 1.9.1, the RenameFileHandler function in internal/handlers/files.go (Files Rename API component) is vulnerable to path traversal via manipulation of the currentPath/newName arguments. The attack can be initiated remotely, and a public exploit may be used in attacks.
Original NVD description (English source)
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS