CVE-2026-114376 in wiki-go
Summary
by MITRE • 10/21/2026
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.9.2 addresses this issue. This patch is called 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8. Upgrading the affected component is advised.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in leomoon-studios wiki-go versions up to 1.9.1 represents a critical security flaw within the application's API layer, specifically located in the SaveHandler and SourceHandler functions found in the internal/handlers/editor.go file. This weakness is classified as a Path Traversal vulnerability, which falls under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical issue stems from insufficient validation or sanitization of user-supplied input when handling file operations. When an attacker provides a filename or path parameter containing directory traversal sequences, such as dot-dot-slash (../), the application fails to properly restrict access to the intended directory structure. Instead, it interprets these sequences literally and resolves them relative to the current working directory, allowing the operation to escape the designated sandboxed area.
This flaw enables a remote attacker to read arbitrary files from the server's file system or potentially write malicious content into sensitive locations if write permissions are granted through similar handlers. The operational impact of this vulnerability is severe because it can lead to unauthorized disclosure of confidential information, including configuration files containing database credentials, API keys, and other secrets stored on the host machine. In more complex scenarios where the application runs with elevated privileges or allows file overwrites in executable directories, an attacker could achieve remote code execution by uploading a web shell or replacing critical system binaries. The fact that this vulnerability has been publicly exploited indicates that automated scanners and threat actors are actively targeting instances of wiki-go running vulnerable versions, increasing the likelihood of successful compromise for unpatched systems.
From a tactical perspective, this attack vector aligns with MITRE ATT&CK techniques related to Collection via File and Directory Discovery (T1083) and potentially Data from Local System (T1005). The ability to traverse paths allows an attacker to map the internal file structure of the server, identifying high-value targets for further exploitation. Since the exploit is publicly available, defenders must assume that active probing or attacks are occurring against any exposed instance of this software. The lack of robust input validation in the editor component highlights a common oversight in web application development where convenience features like dynamic file saving are implemented without adequate security controls to prevent path manipulation.
To mitigate this risk, immediate action is required to upgrade leomoon-studios wiki-go to version 1.9.2 or later. The patch associated with commit hash 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8 addresses the underlying logic error by implementing stricter path validation and canonicalization checks before processing file operations. This ensures that any user-supplied paths are resolved to their absolute form and verified against a whitelist of allowed directories, effectively neutralizing traversal attempts. In addition to upgrading, organizations should implement network-level controls such as web application firewalls to detect and block common path traversal patterns in HTTP requests. Regular security audits and static code analysis focused on file handling functions can also help prevent similar vulnerabilities from being introduced into the codebase in future updates.