CVE-2026-92775
MediumCVSS 6.5Summary
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.
Risk Assessment
A user with editing permissions can reach internal services and cloud credentials, risking privilege escalation and infrastructure compromise. SSRF can be used to map and attack the internal network.
Recommendation
Upgrade Wiki.js beyond version 2.5.314. Restrict server egress traffic and block access to cloud metadata endpoints and internal services.
Other vulnerabilities in Wiki.js
See all- CVE-2026-92776High
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
- CVE-2026-92774Medium
Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metadata including titles, descriptions, paths, and tag information without proper authorization.
- CVE-2026-44224High
Wiki.js prior to version 2.5.313 has a vulnerability that allows users to self-assign to the Administrators group by modifying arguments in the GraphQL mutation. The lack of validation on group IDs enables unauthorized elevation of privileges.
- CVE-2025-56643Critical
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. The issue is present in the authentication resolver logic and affects both the GraphQL endpoint and the logout mechanism.
Original NVD description (English source)
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.