{"id":"CVE-2026-114374","kind":"vulnerability","aliases":["CVE-2026-114374"],"related":[],"title":"wiki-go: metadata fetch endpoint allows server-side request forgery","description":"A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.","summary":"The fetch-metadata endpoint in wiki-go up to 1.9.1 does not properly control URLs it requests, enabling server-side request forgery. A remote attacker can make the server send requests to hosts of their choosing, which can reach internal services.","severity":"medium","cvss":4.3,"epss":0.00237,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wiki-go"],"not_affected_if":["wiki-go-1.9.2-or-later"],"how_to_check":"- Check the installed wiki-go version against `1.9.2`\n- Look for the metadata API route in `internal/handlers/metadata_api.go` in the source tree","fix":"- Upgrade wiki-go to `1.9.2` (patch `25498ebf5c012b870967e38eec2a1e5133fa1a83`)","status":"open","published_at":"2026-10-21T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:37:37+00:00","updated_at":"2026-10-25T04:37:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:37:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade wiki-go to `1.9.2` (patch `25498ebf5c012b870967e38eec2a1e5133fa1a83`)","reach":"internet","title":"wiki-go: metadata fetch endpoint allows server-side request forgery","impact":"medium","summary":"The fetch-metadata endpoint in wiki-go up to 1.9.1 does not properly control URLs it requests, enabling server-side request forgery. A remote attacker can make the server send requests to hosts of their choosing, which can reach internal services.","category":"package","nicknames":[],"who_cares":["wiki-go","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server makes internal network requests on attacker's behalf","analyst_note":"Confirm whether the fetch-metadata endpoint requires authentication and is enabled by default, using the NVD entry and the upstream commit 25498ebf5c012b870967e38eec2a1e5133fa1a83.","how_to_check":"- Check the installed wiki-go version against `1.9.2`\n- Look for the metadata API route in `internal/handlers/metadata_api.go` in the source tree","needs_analyst":true,"not_affected_if":["wiki-go-1.9.2-or-later"],"who_is_affected":"Deployments of wiki-go at version 1.9.1 or earlier that expose the fetch-metadata endpoint to users are exposed. The sources do not say whether the endpoint is on by default or needs an account, so unknown. Instances that do not run wiki-go, or that run 1.9.2 or later, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3438,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114374':15A,18A '-2026':14A,17A '1.9.1':37B,83C '1.9.2':129C '25498ebf5c012b870967e38eec2a1e5133fa1a83':140C 'affect':143C 'allow':7A 'attack':53B,115C 'avail':121C 'choos':64B 'compon':95C,144C 'control':41B 'cve':13A,16A 'enabl':45B 'endpoint':6A,30B,99C 'exploit':118C 'fetch':5A,28B,97C 'fetch-metadata':27B,96C 'file':91C 'fix':131C 'forgeri':12A,50B,108C 'function':88C 'go':3A,25B,34B,80C 'host':22B,61B 'identifi':73C 'impact':85C 'intern':68B 'internal/handlers/metadata_api.go':92C 'issu':133C 'launch':113C 'lead':102C 'leomoon':76C 'leomoon-studio':75C 'make':55B 'manipul':101C 'metadata':4A,29B,98C 'might':123C 'name':135C 'packag':19B 'patch':138C 'possibl':111C 'proper':40B 'public':120C 'reach':67B 'recommend':146C 'remot':52B,116C 'request':11A,44B,49B,59B,107C 'self':21B 'self-host':20B 'send':58B 'server':9A,47B,57B,105C 'server-sid':8A,46B,104C 'servic':69B 'side':10A,48B,106C 'studio':77C 'unknown':87C 'upgrad':126C,141C 'url':42B 'use':125C 'version':128C 'vulner':71C 'wiki':2A,24B,33B,79C 'wiki-go':1A,23B,32B,78C","nicknames":[],"mitigations":[],"who_affected":"Deployments of wiki-go at version 1.9.1 or earlier that expose the fetch-metadata endpoint to users are exposed. The sources do not say whether the endpoint is on by default or needs an account, so unknown. Instances that do not run wiki-go, or that run 1.9.2 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114374","severity":null,"published_at":"2026-10-21T20:17:25+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114374","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114374","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}