Leomoon wiki-go EUVD-2026-107545

Requires an authenticated session with at least editor-level privileges (PR:L) and network access to the wiki-go HTTP API, specifically the document editor endpoints handled by SaveHandler/SourceHandler in internal/handlers/editor.go (e.g. /api/save/<path> and /api/source/<path>). The attacker must supply a crafted document path containing traversal sequences - the patch and its test target backslash encoding ('..%5c' / '..\\') - to escape the configured documents directory. Exploitation is limited by the authentication requirement (no anonymous/unauthenticated path), so deployments that do not grant editor accounts to untrusted users face substantially lower real-world risk; affected versions are wiki-go up to and including 1.9.1, fixed in 1.9.2.

This is a moderate, not top-priority, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw but one that requires authentication - PR:L maps to a low-privileged account, confirmed by the patch's test harness which exercises the attack using an 'editor' role session cookie. Impact is bounded: VC:L/VI:L/VA:L (and 3.1-equivalent C:L/I:L/A:L) indicate limited read and write of files outside the intended documents directory rather than full system compromise, with no scope/subsequent-system impact (SC:N/SI:N/SA:N). Exploit maturity is E:P (proof-of-concept), consistent with the input signal that public exploit code exists via the GHSA advisory; this is POC availability, NOT confirmed active exploitation. KEV status is not present in the input (treat as not KEV-listed) and no EPSS score was provided, so there is no evidence of mass exploitation - the realistic risk is opportunistic abuse by an already-authenticated low-privilege user rather than unauthenticated internet-wide attack. No signals conflict; the main caveat is that risk depends entirely on how freely editor-level accounts are provisioned in a given deployment.

An authenticated low-privilege 'editor' user sends a request to the wiki-go API (e.g. /api/save or /api/source) with a document path containing backslash traversal sequences such as '..%5coutside', causing SaveHandler/SourceHandler to resolve a path outside the configured documents directory. This lets the attacker read sensitive files or overwrite/create files beyond the wiki's content area. Public proof-of-concept exploit code exists (referenced in the vendor GHSA advisory), lowering the effort to reproduce.