CVE-2026-92775 is a server-side request forgery vulnerability in Wiki.js through version 2.5.314. The vulnerability exists in the Image Prefetch renderer component, which fetches URLs embedded in img elements with the prefetch-candidate class without proper validation of protocol, host, or address. An attacker who has page editing permissions can exploit this to make the server perform requests to internal services or cloud metadata endpoints, potentially exposing sensitive information. The CVSS 4.0 base score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required beyond page editing, and high impact on confidentiality.

An attacker with page editing permissions can exploit this SSRF vulnerability to cause the Wiki.js server to make unauthorized requests to internal services and cloud metadata endpoints. This can lead to exposure of sensitive internal information or cloud instance metadata, which may facilitate further attacks or data leakage. The vulnerability does not require user interaction and has a network attack vector, increasing its risk in environments where page editing permissions are granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict page editing permissions to trusted users only to reduce the risk of exploitation. Monitor for suspicious activity related to image prefetching and consider disabling or restricting the Image Prefetch renderer feature if possible.