wiki-go CVE-2026-114377

Requires an authenticated wiki-go administrator session: the vulnerable DeleteComment handler only executes when userIsAdmin is true, and the attacker must control the documentPath argument sent to the comment-deletion endpoint, supplying traversal sequences (e.g. ../, ..\, or encoded %2e%2e per the added test cases). Affected versions are wiki-go up to and including 1.9.1; 1.9.2 adds path containment. Limiting factors: the admin-privilege requirement (PR:H) is the primary constraint, drastically reducing the viable attacker set; no user interaction is needed (UI:N) and the endpoint is remotely reachable (AV:N), but exploitation is impossible without prior administrative access.

This is a genuine but modest-priority issue. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:N/VI:L/VA:L) scores 5.1 (Medium), and the signals are internally consistent rather than conflicting: network-reachable (AV:N) and low-complexity (AC:L), but gated behind high privileges (PR:H). The source code confirms why PR:H is correct - DeleteComment only proceeds when userIsAdmin is true, so an attacker must already hold wiki-go administrator rights. A publicly available exploit exists (POC=YES), which raises operational concern, but the CVSS 4.0 vector carries E:P (Proof-of-Concept exploit maturity), not evidence of active campaigns. The CVE is NOT in CISA KEV, so this is: publicly available exploit code exists, with no public evidence of active exploitation. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be factored in. Impact is bounded - no confidentiality loss (VC:N) and only Low integrity/availability impact (VI:L/VA:L), reflecting that the path-traversal sink is os.Remove (arbitrary file deletion) rather than code execution or data theft. Net assessment: a real, patch-worthy vulnerability but not an emergency, because the admin-privilege prerequisite sharply limits the realistic attacker population.

An authenticated wiki-go administrator (or an attacker who has compromised an admin session) sends a comment-deletion request in which the documentPath parameter contains directory-traversal sequences (e.g. ../../). Because DeleteComment joined documentPath into data/comments without containment, os.Remove operates on a file outside the comments directory, allowing deletion of arbitrary server files. A public exploit/advisory (GHSA-g86r-58wp-4v86) is available, lowering the effort to reproduce.