rootpwn

high · CVSS v3 6.5 · CVSS v4 7.1

CVE-2026-92775

A server-side request forgery (SSRF) vulnerability exists in Wiki.js versions up to 2.5.314 within its Image Prefetch renderer component. Th

Overview

A server-side request forgery (SSRF) vulnerability exists in Wiki.js versions up to 2.5.314 within its Image Prefetch renderer component. The application fails to validate protocol, host, or network addresses when fetching external image resources during prefetching. Authenticated users with page editing privileges can leverage this weakness to cause the server to perform HTTP requests to internal services and cloud metadata endpoints.

Description

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.

Impact

Impacts organizations deploying Wiki.js on internal networks or in cloud environments. Successful exploitation compromised Confidentiality by exposing responses from internal network endpoints and cloud service metadata to authenticated editors, potentially compromising Integrity and Availability depending on accessible internal interfaces.

Remediation

Upgrade Wiki.js to a version higher than 2.5.314 where SSRF protections are implemented. Implement strict egress filtering on the server hosting Wiki.js to block requests to RFC 1918 private address spaces and cloud instance metadata service IPs (e.g., 169.254.169.254). Audit and limit page editing privileges to trusted accounts.

Risk context

The vulnerability carries a High severity rating (CVSS v3: 6.5, CVSS v4: 7.1) with no current EPSS score available. While attack execution requires authenticated page editing permissions, the threat to cloud metadata endpoints warrants immediate review for cloud-hosted environments.

Affected products

  • Requarks Wiki.js <= 2.5.314

Scores

Severity
high
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
7.1
EPSS
—

Wiki.js SSRF CVE-2026-92775 Access Control Cloud Security Patch Management

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis