---
id: "CVE-2026-114374"
kind: "vulnerability"
aliases: ["CVE-2026-114374"]
title: "wiki-go: metadata fetch endpoint allows server-side request forgery"
severity: "medium"
cvss: 4.3
epss: 0.00237
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wiki-go"]
not_affected_if: ["wiki-go-1.9.2-or-later"]
published_at: "2026-10-21T20:17:25+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:37:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114374", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114374", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# wiki-go: metadata fetch endpoint allows server-side request forgery

The fetch-metadata endpoint in wiki-go up to 1.9.1 does not properly control URLs it requests, enabling server-side request forgery. A remote attacker can make the server send requests to hosts of their choosing, which can reach internal services.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed wiki-go version against `1.9.2`
- Look for the metadata API route in `internal/handlers/metadata_api.go` in the source tree

## Fix

- Upgrade wiki-go to `1.9.2` (patch `25498ebf5c012b870967e38eec2a1e5133fa1a83`)

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114374
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114374

## From the sources

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_