Requarks
Monthly
Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one folder to read and modify unrelated pages whose paths share a literal prefix with that folder (for example, access to '/docs' also exposes '/docs-internal'). The flaw lies in the START/END page-rule engine, which matches path prefixes without requiring a path-segment boundary. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) at time of analysis. No vendor-released patch version is identified in the available data, and the assessed CVSS 3.1 base score is 8.1 (High).
Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions force the server to fetch arbitrary URLs on their behalf, including internal services and cloud instance metadata endpoints, with the fetched response returned to the attacker. The flaw sits in the Image Prefetch renderer, which resolves the src of any img element tagged with the prefetch-candidate class without validating protocol, host, or resolved address; publicly available exploit code exists, and the assessed impact is information disclosure only (high confidentiality, no integrity or availability effect). Exploitation is constrained by the need for an account with editing rights and by the server's network reachability to the intended internal or metadata target, making this a genuine but moderate-priority issue rather than a pre-auth or remote-code-execution class bug.
Vertical privilege escalation in Wiki.js before 2.5.313 lets an account-management moderator promote themselves to full site administrator through the users.update GraphQL mutation. Because the resolver applies a caller-supplied groups array to the database with no ownership or group-ID validation, any user holding the manage:users permission can set groups:[1] on their own account and, after re-authentication, receive a JWT carrying manage:system. SSVC rates technical impact as total; publicly available advisory exists (GHSA-cq3g-mwrg-v2rv) but no public exploit code and no active exploitation, with EPSS at a low 0.04%.
Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page metadata without evaluating page tags, allowing an authenticated user to enumerate titles, descriptions, paths, and tags of pages they should not see. Publicly available exploit code exists, and the supplied intelligence maps the issue to CWE-863, but the authoritative assessment rates it as a low-severity information-disclosure bug: it requires an account with GraphQL API access, affects deployments that actually use tag-based page rules, and exposes metadata only, not page content, with no integrity or availability impact.
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Wiki.js is a wiki app built on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Wiki.js an open-source wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one folder to read and modify unrelated pages whose paths share a literal prefix with that folder (for example, access to '/docs' also exposes '/docs-internal'). The flaw lies in the START/END page-rule engine, which matches path prefixes without requiring a path-segment boundary. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) at time of analysis. No vendor-released patch version is identified in the available data, and the assessed CVSS 3.1 base score is 8.1 (High).
Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions force the server to fetch arbitrary URLs on their behalf, including internal services and cloud instance metadata endpoints, with the fetched response returned to the attacker. The flaw sits in the Image Prefetch renderer, which resolves the src of any img element tagged with the prefetch-candidate class without validating protocol, host, or resolved address; publicly available exploit code exists, and the assessed impact is information disclosure only (high confidentiality, no integrity or availability effect). Exploitation is constrained by the need for an account with editing rights and by the server's network reachability to the intended internal or metadata target, making this a genuine but moderate-priority issue rather than a pre-auth or remote-code-execution class bug.
Vertical privilege escalation in Wiki.js before 2.5.313 lets an account-management moderator promote themselves to full site administrator through the users.update GraphQL mutation. Because the resolver applies a caller-supplied groups array to the database with no ownership or group-ID validation, any user holding the manage:users permission can set groups:[1] on their own account and, after re-authentication, receive a JWT carrying manage:system. SSVC rates technical impact as total; publicly available advisory exists (GHSA-cq3g-mwrg-v2rv) but no public exploit code and no active exploitation, with EPSS at a low 0.04%.
Tag-based page access restrictions in Wiki.js through 2.5.314 are bypassed because several GraphQL resolvers return page metadata without evaluating page tags, allowing an authenticated user to enumerate titles, descriptions, paths, and tags of pages they should not see. Publicly available exploit code exists, and the supplied intelligence maps the issue to CWE-863, but the authoritative assessment rates it as a low-severity information-disclosure bug: it requires an account with GraphQL API access, affects deployments that actually use tag-based page rules, and exposes metadata only, not page content, with no integrity or availability impact.
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Wiki.js is a wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Wiki.js is a wiki app built on Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Wiki.js an open-source wiki app built on Node.js. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.