CVE-2026-114377 in wiki-go
Summary
by MITRE • 10/21/2026
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in leomoon-studios wiki-go versions up to 1.9.1 represents a critical path traversal flaw within the application's comment management subsystem. Specifically, this issue resides in the DeleteComment function located in the internal/comments/comments.go file, which serves as the Comment Deletion Handler for the platform. The core technical deficiency involves an insufficient validation of user-supplied input regarding the documentPath argument. When processing deletion requests, the system fails to properly sanitize or canonicalize the provided path string before using it to access the underlying filesystem. This lack of rigorous input validation allows an attacker to inject directory traversal sequences, such as dot-dot-slash characters, into the request parameters. By manipulating this specific argument, a malicious actor can break out of the intended application directories and traverse up the file system hierarchy to target arbitrary files or directories that are not meant to be accessible through the comment deletion interface.
From an operational perspective, this vulnerability poses significant risks due to its remote exploitability. Because the flaw is triggered via network requests rather than requiring local access or physical interaction with the server, it can be initiated remotely by any actor who has network connectivity to the affected service. The fact that a public proof-of-concept exists and has been disclosed means that automated scanning tools and malicious actors are likely already attempting to exploit this weakness in the wild. Successful exploitation could lead to unauthorized file deletion or modification of critical system files, potentially resulting in data loss, denial of service conditions by corrupting essential configuration files, or further compromise if sensitive information is exposed through subsequent actions enabled by the traversal. This aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, highlighting the failure to enforce strict boundaries on file system access operations based on user input.
The attack vector for this vulnerability falls under the MITRE ATT&CK framework category of Initial Access or Execution, depending on how the traversal is leveraged further. If an attacker uses path traversal to delete configuration files that control authentication mechanisms, it could facilitate unauthorized access. Alternatively, if they overwrite script files within web-accessible directories via a write-enabled traversal variant (though this specific description focuses on deletion), it could lead to remote code execution. The primary immediate impact is the integrity compromise of the file system associated with the wiki-go application. Administrators must recognize that leaving this vulnerability unpatched exposes the infrastructure to automated attacks and targeted exploitation by threat actors who monitor public disclosure channels for actionable vulnerabilities in widely used open-source projects like wiki-go.
To mitigate this risk, it is imperative to upgrade leomoon-studios wiki-go immediately to version 1.9.2 or later. The patch associated with commit identifier 224ef2a11facddef6b3a3c1f0a69156d1e574a33 addresses the input validation logic within the DeleteComment function, ensuring that document paths are strictly validated against a whitelist of allowed directories or properly canonicalized to prevent directory traversal sequences from being interpreted as valid file system operations. In addition to upgrading, organizations should implement defense-in-depth strategies such as running the application with minimal filesystem permissions and utilizing web application firewalls to detect and block common path traversal patterns in HTTP requests until the patch is fully deployed across all instances of the software.