Live › vulnerability › CVE-2026-114375
Go to dashboardwiki-go up to 1.9.1 has a path traversal flaw in the Files Rename API (RenameFileHandler in internal/handlers/files.go) where the currentPath or newName argument is not constrained. A remote attacker can use it to move or rename files outside the intended directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running leomoon-studios wiki-go at version 1.9.1 or earlier that expose the file rename endpoint to users. The sources do not say whether specific deployment modes or configurations change exposure. Instances already on 1.9.2 are not affected.
No product ranges from the sources yet.
1.9.1 or earlier81cd12e248314a52605f0f39718c8a76272eac29 is in the deployed build1.9.2, which the sources say addresses this issueEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-114375")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.