Search
Find a vulnerability
Search criteria
8 vulnerabilities by leomoon-studios
CVE-2026-114377 (GCVE-0-2026-114377)
Vulnerability from nvd – Published: 2026-10-21 20:15 – Updated: 2026-10-21 20:15 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
Summary
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424734 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424734/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114377 | third-party-advisory |
| https://vuldb.com/submit/1019399 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Comment Deletion Handler"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.7,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:15:18.610Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424734 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424734"
},
{
"name": "VDB-424734 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424734/cti"
},
{
"name": "CVE-2026-114377 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114377"
},
{
"name": "Submit #1019399 | leomoon-studios wiki-go \u003c= 1.9.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019399"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-g86r-58wp-4v86"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/224ef2a11facddef6b3a3c1f0a69156d1e574a33"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114377",
"datePublished": "2026-10-21T20:15:18.610Z",
"dateReserved": "2026-10-21T11:12:00.918Z",
"dateUpdated": "2026-10-21T20:15:18.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114376 (GCVE-0-2026-114376)
Vulnerability from nvd – Published: 2026-10-21 20:00 – Updated: 2026-10-21 20:00 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go API editor.go SourceHandler path traversal
Summary
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.9.2 addresses this issue. This patch is called 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8. Upgrading the affected component is advised.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424733 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424733/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114376 | third-party-advisory |
| https://vuldb.com/submit/1019390 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"API"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.9.2 addresses this issue. This patch is called 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:00:12.433Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424733 | leomoon-studios wiki-go API editor.go SourceHandler path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424733"
},
{
"name": "VDB-424733 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424733/cti"
},
{
"name": "CVE-2026-114376 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114376"
},
{
"name": "Submit #1019390 | leomoon-studios wiki-go \u003c= 1.9.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019390"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-wv68-7fq9-834c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/94f7e73ef8df7c58091d72d77a5e26e9fdad98b8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go API editor.go SourceHandler path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114376",
"datePublished": "2026-10-21T20:00:12.433Z",
"dateReserved": "2026-10-21T11:11:56.110Z",
"dateUpdated": "2026-10-21T20:00:12.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114375 (GCVE-0-2026-114375)
Vulnerability from nvd – Published: 2026-10-21 19:45 – Updated: 2026-10-21 19:45 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
Summary
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424732 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424732/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114375 | third-party-advisory |
| https://vuldb.com/submit/1019389 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Files Rename API"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T19:45:20.856Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424732 | leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424732"
},
{
"name": "VDB-424732 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424732/cti"
},
{
"name": "CVE-2026-114375 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114375"
},
{
"name": "Submit #1019389 | leomoon-studios wiki-go \u003c= 1.9.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019389"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-xg75-vx57-m5mx"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/81cd12e248314a52605f0f39718c8a76272eac29"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114375",
"datePublished": "2026-10-21T19:45:20.856Z",
"dateReserved": "2026-10-21T11:11:50.633Z",
"dateUpdated": "2026-10-21T19:45:20.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114374 (GCVE-0-2026-114374)
Vulnerability from nvd – Published: 2026-10-21 19:30 – Updated: 2026-10-21 19:30 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
Summary
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424731 | vdb-entry |
| https://vuldb.com/vuln/424731/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114374 | third-party-advisory |
| https://vuldb.com/submit/1019388 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"fetch-metadata Endpoint"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T19:30:14.688Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424731 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/424731"
},
{
"name": "VDB-424731 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424731/cti"
},
{
"name": "CVE-2026-114374 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114374"
},
{
"name": "Submit #1019388 | leomoon-studios wiki-go \u003c= 1.9.1 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019388"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-7q4p-98g4-pwp7"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/25498ebf5c012b870967e38eec2a1e5133fa1a83"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114374",
"datePublished": "2026-10-21T19:30:14.688Z",
"dateReserved": "2026-10-21T11:11:46.623Z",
"dateUpdated": "2026-10-21T19:30:14.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114377 (GCVE-0-2026-114377)
Vulnerability from cvelistv5 – Published: 2026-10-21 20:15 – Updated: 2026-10-21 20:15 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
Summary
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424734 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424734/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114377 | third-party-advisory |
| https://vuldb.com/submit/1019399 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Comment Deletion Handler"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.8,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.7,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:15:18.610Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424734 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424734"
},
{
"name": "VDB-424734 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424734/cti"
},
{
"name": "CVE-2026-114377 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114377"
},
{
"name": "Submit #1019399 | leomoon-studios wiki-go \u003c= 1.9.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019399"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-g86r-58wp-4v86"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/224ef2a11facddef6b3a3c1f0a69156d1e574a33"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114377",
"datePublished": "2026-10-21T20:15:18.610Z",
"dateReserved": "2026-10-21T11:12:00.918Z",
"dateUpdated": "2026-10-21T20:15:18.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114376 (GCVE-0-2026-114376)
Vulnerability from cvelistv5 – Published: 2026-10-21 20:00 – Updated: 2026-10-21 20:00 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go API editor.go SourceHandler path traversal
Summary
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.9.2 addresses this issue. This patch is called 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8. Upgrading the affected component is advised.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424733 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424733/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114376 | third-party-advisory |
| https://vuldb.com/submit/1019390 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"API"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.9.2 addresses this issue. This patch is called 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T20:00:12.433Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424733 | leomoon-studios wiki-go API editor.go SourceHandler path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424733"
},
{
"name": "VDB-424733 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424733/cti"
},
{
"name": "CVE-2026-114376 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114376"
},
{
"name": "Submit #1019390 | leomoon-studios wiki-go \u003c= 1.9.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019390"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-wv68-7fq9-834c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/94f7e73ef8df7c58091d72d77a5e26e9fdad98b8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go API editor.go SourceHandler path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114376",
"datePublished": "2026-10-21T20:00:12.433Z",
"dateReserved": "2026-10-21T11:11:56.110Z",
"dateUpdated": "2026-10-21T20:00:12.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114375 (GCVE-0-2026-114375)
Vulnerability from cvelistv5 – Published: 2026-10-21 19:45 – Updated: 2026-10-21 19:45 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
Summary
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424732 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/424732/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114375 | third-party-advisory |
| https://vuldb.com/submit/1019389 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Files Rename API"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T19:45:20.856Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424732 | leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/424732"
},
{
"name": "VDB-424732 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424732/cti"
},
{
"name": "CVE-2026-114375 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114375"
},
{
"name": "Submit #1019389 | leomoon-studios wiki-go \u003c= 1.9.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019389"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-xg75-vx57-m5mx"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/81cd12e248314a52605f0f39718c8a76272eac29"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114375",
"datePublished": "2026-10-21T19:45:20.856Z",
"dateReserved": "2026-10-21T11:11:50.633Z",
"dateUpdated": "2026-10-21T19:45:20.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114374 (GCVE-0-2026-114374)
Vulnerability from cvelistv5 – Published: 2026-10-21 19:30 – Updated: 2026-10-21 19:30 X_Open Source
VLAI
EPSS
VEX
Title
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
Summary
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
Severity
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/424731 | vdb-entry |
| https://vuldb.com/vuln/424731/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-114374 | third-party-advisory |
| https://vuldb.com/submit/1019388 | third-party-advisory |
| https://github.com/leomoon-studios/wiki-go/securi… | exploit |
| https://github.com/leomoon-studios/wiki-go/commit… | patch |
| https://github.com/leomoon-studios/wiki-go/releas… | patch |
| https://github.com/leomoon-studios/wiki-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| leomoon-studios | wiki-go |
Affected:
1.9.0
Affected: 1.9.1 Unaffected: 1.9.2 cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
],
"modules": [
"fetch-metadata Endpoint"
],
"product": "wiki-go",
"vendor": "leomoon-studios",
"versions": [
{
"status": "affected",
"version": "1.9.0"
},
{
"status": "affected",
"version": "1.9.1"
},
{
"status": "unaffected",
"version": "1.9.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T19:30:14.688Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-424731 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/424731"
},
{
"name": "VDB-424731 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/424731/cti"
},
{
"name": "CVE-2026-114374 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-114374"
},
{
"name": "Submit #1019388 | leomoon-studios wiki-go \u003c= 1.9.1 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019388"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-7q4p-98g4-pwp7"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/commit/25498ebf5c012b870967e38eec2a1e5133fa1a83"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/leomoon-studios/wiki-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-21T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-21T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T13:17:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-114374",
"datePublished": "2026-10-21T19:30:14.688Z",
"dateReserved": "2026-10-21T11:11:46.623Z",
"dateUpdated": "2026-10-21T19:30:14.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}