wiki-go EUVD-2026-107543

Requires an authenticated session with at least low privileges (CVSS PR:L) on a wiki-go instance at version 1.9.1 or earlier, plus access to the Files Rename API (RenameFileHandler). The specific prerequisite is attacker control over the currentPath and/or newName parameters, into which traversal sequences (e.g. ../ or absolute/backslash paths, per the patch's new absolute-path and parent-segment checks) are injected to escape the documents or pages/home storage roots. Limiting factors: exploitation is gated by the authentication requirement (not pre-auth), is remediated in v1.9.2, and no user interaction is needed (UI:N); impact is bounded to file rename/relocation operations rather than full code execution.

This is a medium-severity, authenticated path traversal (CWE-22) in a niche open-source Go wiki, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack that nonetheless requires low-level authentication (PR:L), so it is not a pre-auth mass-exploitation candidate. Impacts are rated low across the board (VC:L/VI:L/VA:L), and the vendor/VulDB score of 5.3 (E:P, proof-of-concept) reflects that scope is unchanged and no single impact is complete. Publicly available exploit code exists, which raises opportunistic risk, but there is NO CISA KEV listing and no EPSS figure was provided in the input - so there is no evidence of active, widespread exploitation, and the POC signal should not be conflated with in-the-wild use. Net: a real but modest priority - patch it as part of normal maintenance, prioritizing instances exposed to untrusted authenticated users; the limited product footprint and authentication requirement keep real-world risk well below what a raw 'remote + public exploit' reading might suggest.

An attacker who already holds a low-privileged authenticated account on a wiki-go instance (≤1.9.1) calls the Files Rename API and supplies crafted currentPath/newName values containing traversal sequences, causing the RenameFileHandler to operate on files outside the intended documents/homepage roots. A public proof-of-concept exists (referenced via the GHSA advisory), lowering the skill needed; because the CVSS vector is AV:N/AC:L, the request is a straightforward remote HTTP call with no user interaction. Realistic outcomes are renaming or clobbering files outside the wiki storage root, degrading integrity/availability of the host's file layout.