EUVD-2026-81039
GHSA-7mqp-q79v-g27v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity SSRF requiring an authenticated editor (PR:L); non-blind responses return sensitive internal/metadata data (C:H) with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.
AnalysisAI
Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions force the server to fetch arbitrary URLs on their behalf, including internal services and cloud instance metadata endpoints, with the fetched response returned to the attacker. The flaw sits in the Image Prefetch renderer, which resolves the src of any img element tagged with the prefetch-candidate class without validating protocol, host, or resolved address; publicly available exploit code exists, and the assessed impact is information disclosure only (high confidentiality, no integrity or availability effect). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Wiki.js account with page-editing permissions (PR:L); anonymous/unauthenticated users cannot reach the vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis: the available references point to the vulnerable 2.5.314 source file and to the VulnCheck advisory (https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-server-side-request-forgery-via-image-prefetch), which is accompanied by public proof-of-concept material (https://github.com/geo-chen/oss/blob/main/wiki.md), but no fixed release, commit, or PR is cited, so administrators should track the upstream project at github.com/requarks/wiki for a patched version and treat any future release note referencing the html-image-prefetch renderer as the fix indicator. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which Wiki.js instances run version 2.5.314 or earlier, inventory who holds page-editing permissions, and review egress logs for outbound requests to internal address ranges or the cloud metadata endpoint 169.254.169.254; where the Image Prefetch renderer or its prefetch-candidate handling can be disabled or configured off, do so, and if not, temporarily reduce page-editing grants to the minimum necessary set of users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one
Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. Rated high
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo
Wiki.js is a wiki app built on node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo
Wiki.js an open-source wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely explo
Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page
Wiki.js is a wiki app built on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, lo
In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. Rated medium severity (CVS
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today