Wiki Go
Monthly
Path traversal in the comment-deletion handler of LeoMoon Studios wiki-go through 1.9.1 allows an authenticated wiki administrator to delete files outside the intended comments directory by supplying traversal sequences (such as ../, ..\, or URL-encoded %2e%2e) in the documentPath argument of the comment-deletion request. Because the endpoint is reachable remotely and requires no user interaction, a malicious or compromised admin account can remove arbitrary files writable by the wiki-go process, affecting integrity and availability (assessed CVSS:3.1 AV:N/AC:L/PR:H/UI:N/C:N/I:L/A:L); the file contents are not exposed. Publicly available exploit code exists and the flaw is described in a GitHub security advisory, but there is no indication of active exploitation in the wild. The issue is a genuine but modest-priority one, primarily constrained by the administrative-privilege prerequisite, and is fixed in version 1.9.2.
Path traversal in Leomoon wiki-go through 1.9.1 allows authenticated users with editor-level privileges to read, overwrite, move, or restore documents outside the configured wiki documents directory via crafted paths to the editor and version API endpoints. The flaw is remotely reachable over HTTP but requires a valid editor session (CVSS PR:L); publicly available exploit code exists, and the vendor fixed it in 1.9.2. It is a moderate-risk issue rather than a top-priority one because untrusted users cannot exploit it without editor access.
Authenticated path traversal in wiki-go 1.9.1 and earlier lets low-privileged users abuse the Files Rename API to move or rename files outside the wiki's documents or pages/home storage roots. The flaw is in RenameFileHandler's handling of the currentPath and newName arguments, which accept traversal sequences such as ../ or absolute/backslash paths; publicly available exploit code exists. The vendor fixed it in 1.9.2, and the moderate CVSS 5.3 reflects limited confidentiality, integrity, and availability impact rather than code execution; no CISA KEV confirmation was provided.
Authenticated server-side request forgery (SSRF) in wiki-go versions up to 1.9.1 allows logged-in users to make the server fetch arbitrary internal or cloud-metadata URLs through the fetch-metadata endpoint in internal/handlers/metadata_api.go. The pre-patch handler only checked the URL scheme (http/https) and never validated the resolved destination IP, so an attacker with valid credentials can read limited confidential responses from reachable internal services (confidentiality impact only, no integrity or availability impact). Publicly available exploit code exists, and the vendor fixed the issue in 1.9.2 by adding outbound URL destination validation.
Path traversal in the comment-deletion handler of LeoMoon Studios wiki-go through 1.9.1 allows an authenticated wiki administrator to delete files outside the intended comments directory by supplying traversal sequences (such as ../, ..\, or URL-encoded %2e%2e) in the documentPath argument of the comment-deletion request. Because the endpoint is reachable remotely and requires no user interaction, a malicious or compromised admin account can remove arbitrary files writable by the wiki-go process, affecting integrity and availability (assessed CVSS:3.1 AV:N/AC:L/PR:H/UI:N/C:N/I:L/A:L); the file contents are not exposed. Publicly available exploit code exists and the flaw is described in a GitHub security advisory, but there is no indication of active exploitation in the wild. The issue is a genuine but modest-priority one, primarily constrained by the administrative-privilege prerequisite, and is fixed in version 1.9.2.
Path traversal in Leomoon wiki-go through 1.9.1 allows authenticated users with editor-level privileges to read, overwrite, move, or restore documents outside the configured wiki documents directory via crafted paths to the editor and version API endpoints. The flaw is remotely reachable over HTTP but requires a valid editor session (CVSS PR:L); publicly available exploit code exists, and the vendor fixed it in 1.9.2. It is a moderate-risk issue rather than a top-priority one because untrusted users cannot exploit it without editor access.
Authenticated path traversal in wiki-go 1.9.1 and earlier lets low-privileged users abuse the Files Rename API to move or rename files outside the wiki's documents or pages/home storage roots. The flaw is in RenameFileHandler's handling of the currentPath and newName arguments, which accept traversal sequences such as ../ or absolute/backslash paths; publicly available exploit code exists. The vendor fixed it in 1.9.2, and the moderate CVSS 5.3 reflects limited confidentiality, integrity, and availability impact rather than code execution; no CISA KEV confirmation was provided.
Authenticated server-side request forgery (SSRF) in wiki-go versions up to 1.9.1 allows logged-in users to make the server fetch arbitrary internal or cloud-metadata URLs through the fetch-metadata endpoint in internal/handlers/metadata_api.go. The pre-patch handler only checked the URL scheme (http/https) and never validated the resolved destination IP, so an attacker with valid credentials can read limited confidential responses from reachable internal services (confidentiality impact only, no integrity or availability impact). Publicly available exploit code exists, and the vendor fixed the issue in 1.9.2 by adding outbound URL destination validation.