wiki-go EUVD-2026-107539

Requires an authenticated session (CVSS PR:L) with access to the fetch-metadata endpoint handled by internal/handlers/metadata_api.go - this is a server-side URL-preview/metadata feature that fetches a user-supplied target URL. Pre-patch code only checked that the URL scheme was http/https and performed NO validation of the resolved destination IP, so an attacker supplies an internal or cloud-metadata URL and the server fetches it. Limiting factors: the attacker must first obtain valid credentials (not anonymous/unauthenticated), impact is confined to confidentiality of reachable internal responses (no integrity/availability impact), and exploitation value depends on the server having network reachability to sensitive internal endpoints. Affected versions are wiki-go up to and including 1.9.1; upgrading to 1.9.2 adds the validateOutboundMetadataURL destination policy that neutralizes the condition.

This is a medium-severity, authenticated SSRF (CWE-918) in wiki-go's fetch-metadata endpoint, and the signals are internally consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a remotely reachable, low-complexity attack but one that requires at least low-level privileges (PR:L) - i.e., an authenticated user, not an anonymous internet attacker. Impact is constrained: only confidentiality is rated and only as Low (VC:L; VI:N/VA:N), and the vendor marks no subsequent-system impact (SC/SI/SA:N), yielding a base score of 5.3. Exploit maturity is flagged as Proof-of-Concept (E:P), consistent with the publicly available GHSA advisory and VulDB entry. There is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - exploit code exists but exploitation in the wild is not confirmed. Net assessment: this is a real, patch-worthy issue for anyone running internet-facing or multi-tenant wiki-go instances, but it is NOT a drop-everything emergency - the authentication requirement, limited confidentiality-only impact, and absence of KEV/EPSS signals place it as a moderate-priority fix rather than a critical one. The source-code diff corroborates the root cause: the handler previously only validated URL scheme (http/https) and performed no destination/IP filtering before fetching, and the fix introduces validateOutboundMetadataURL plus a new metadata_url_policy.go that resolves and screens outbound hosts.

An authenticated low-privilege wiki-go user submits a crafted URL (e.g., http://169.254.169.254/ or an internal service address) to the fetch-metadata endpoint; the server-side handler fetches that URL without destination validation and returns metadata derived from the response, letting the attacker probe or read internal/cloud-metadata services the server can reach. Publicly available exploit code exists (GHSA-7q4p-98g4-pwp7), lowering the skill barrier, and the CVSS low attack complexity (AC:L) with no user interaction means the request is straightforward to craft once authenticated.