---
id: "CVE-2026-114375"
kind: "vulnerability"
aliases: ["CVE-2026-114375"]
title: "wiki-go: file rename API path traversal lets remote users reach other files"
severity: "medium"
cvss: 6.5
epss: 0.00308
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["go", "package", "self-hosted", "wiki-go"]
not_affected_if: ["version-1.9.2-or-later"]
published_at: "2026-10-21T20:17:26+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:48:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114375", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114375", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# wiki-go: file rename API path traversal lets remote users reach other files

wiki-go up to 1.9.1 has a path traversal flaw in the Files Rename API (RenameFileHandler in internal/handlers/files.go) where the currentPath or newName argument is not constrained. A remote attacker can use it to move or rename files outside the intended directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed wiki-go version and see whether it is `1.9.1` or earlier
- Confirm whether the Files Rename API is reachable from the network
- Check whether the upstream patch commit `81cd12e248314a52605f0f39718c8a76272eac29` is in the deployed build

## Fix

- Upgrade wiki-go to `1.9.2`, which the sources say addresses this issue
- Restrict access to the Files Rename API until the upgrade is done

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114375
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114375

## From the sources

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_