CVE-2026-114375: Path Traversal in leomoon-studios wiki-go

The vulnerability in leomoon-studios wiki-go up to version 1.9.1 is a path traversal issue in the RenameFileHandler function located in internal/handlers/files.go within the Files Rename API component. By manipulating the currentPath or newName parameters, an attacker can traverse directories and potentially access or rename files outside the intended directory scope. This can be exploited remotely without user interaction. The issue is fixed in version 1.9.2 with patch 81cd12e248314a52605f0f39718c8a76272eac29.

Successful exploitation allows remote attackers to perform unauthorized file renaming operations outside the intended directory, potentially leading to unauthorized file access or modification. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Upgrade affected installations of leomoon-studios wiki-go from versions 1.9.0 or 1.9.1 to version 1.9.2, which contains the official fix for this vulnerability. No other mitigation is indicated by the vendor advisory.