CVE-2026-114375 in wiki-go
Summary
by MITRE • 10/21/2026
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in leomoon-studios wiki-go versions up to 1.9.1 represents a critical path traversal flaw within the Files Rename API, specifically located in the RenameFileHandler function found in the internal/handlers/files.go file. This security defect arises from insufficient validation of user-supplied input arguments, namely currentPath and newName. When an attacker manipulates these parameters to include directory traversal sequences such as dot-dot-slash or encoded equivalents, the application fails to properly sanitize the path before processing it. Consequently, this allows for unauthorized access to files and directories outside the intended scope, potentially leading to arbitrary file read operations if combined with other vulnerabilities, or more critically in this context, potential remote code execution depending on how the renamed files are subsequently processed by the system.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The root cause lies in the lack of canonicalization and boundary checking when handling file paths provided through API endpoints. By exploiting this weakness, an attacker can traverse up directory hierarchies using standard path manipulation techniques. Since the attack vector is remote, it does not require local access or authentication if the affected endpoint is publicly accessible without adequate authorization controls. The availability of public exploits significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage known patterns to compromise vulnerable instances. This aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, where adversaries seek to map out file systems for further exploitation or data exfiltration purposes.
The operational impact of this vulnerability is severe due to its potential to disrupt service integrity and confidentiality. Successful exploitation could allow an attacker to overwrite critical configuration files, inject malicious scripts into accessible directories, or delete essential system components by renaming them to obscure locations or overwriting existing binaries. In a wiki application context, compromising file handling mechanisms can lead to defacement of content, theft of sensitive documentation stored within the filesystem, or complete denial of service if core operational files are corrupted or removed. The fact that an exploit has been released publicly means that unpatched systems are immediately vulnerable to automated attacks from botnets and opportunistic hackers scanning for known weaknesses in popular open-source projects.
To mitigate this risk, immediate action is required by upgrading the affected component to version 1.9.2 or later. This update incorporates a patch identified as commit hash 81cd12e248314a52605f0f39718c8a76272eac29, which addresses the input validation deficiencies in the RenameFileHandler function. The fix likely involves implementing strict allow-listing of permitted characters for filenames and paths, ensuring that all inputs are canonicalized before processing to detect any traversal attempts. Additionally, organizations should enforce principle of least privilege by restricting file system permissions so that even if a path traversal occurs, the application process lacks write access to critical directories outside its designated working area. Regular security audits and static code analysis tools configured to detect CWE-22 patterns are recommended to prevent similar issues in future development cycles.