Threats affecting pkg:github/zhimaai/chatwiki

ChatWiki versions prior to 2.10.0 have a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage endpoint. This flaw allows unauthenticated attackers to access PDF-rendered pages of knowledge-base documents belonging to other tenants by enumerating sequential admin_user_id and file id parameters, bypassing ownership checks. The vulnerability is fixed in version 2.10.0.