Threat database

A path traversal vulnerability exists in leomoon-studios wiki-go versions 1.9.0 and 1.9.1 in the DeleteComment function of the internal/comments/comments.go file. This vulnerability allows remote attackers to manipulate the documentPath argument to perform path traversal attacks. The issue is resolved by upgrading to version 1.9.2.

CVE-2026-114376 is a path traversal vulnerability in leomoon-studios wiki-go affecting versions 1.9.0 and 1.9.1. The flaw exists in the SaveHandler/SourceHandler functions within the internal/handlers/editor.go file of the API component. This vulnerability allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The issue is resolved by upgrading to version 1.9.2.

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.

CVE-2026-114374 is a server-side request forgery (SSRF) vulnerability in leomoon-studios wiki-go affecting versions 1.9.0 and 1.9.1. The issue exists in the fetch-metadata endpoint within the internal/handlers/metadata_api.go file. This vulnerability allows remote attackers to manipulate requests, potentially causing the server to make unintended requests. A public exploit is available. Upgrading to version 1.9.2 addresses this vulnerability.