{"id":"CVE-2026-114377","kind":"vulnerability","aliases":["CVE-2026-114377"],"related":[],"title":"wiki-go: comment deletion path traversal lets remote attackers reach other files","description":"A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.","summary":"In leomoon-studios wiki-go up to 1.9.1, the DeleteComment function in internal/comments/comments.go trusts the documentPath argument, so a crafted value causes path traversal. The sources say an attacker can trigger it remotely and that a public exploit exists; they do not say what files can be read or changed.","severity":"medium","cvss":4.7,"epss":0.00399,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["go","package","self-hosted","wiki-go"],"not_affected_if":["patched-version"],"how_to_check":"- Run `wiki-go --version` or check the project's release tag; versions up to `1.9.1` are affected.\n- Check whether the comment deletion endpoint is reachable from the internet.\n- Review the file internal/comments/comments.go for the DeleteComment function and whether documentPath is validated.","fix":"- Upgrade wiki-go to `1.9.2` (patch commit `224ef2a11facddef6b3a3c1f0a69156d1e574a33`).\n- Until upgraded, restrict access to the comment deletion endpoint.","status":"open","published_at":"2026-10-21T21:17:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:34:54+00:00","updated_at":"2026-10-25T04:34:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:34:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade wiki-go to `1.9.2` (patch commit `224ef2a11facddef6b3a3c1f0a69156d1e574a33`).\n- Until upgraded, restrict access to the comment deletion endpoint.","reach":"internet","title":"wiki-go: comment deletion path traversal lets remote attackers reach other files","impact":"medium","summary":"In leomoon-studios wiki-go up to 1.9.1, the DeleteComment function in internal/comments/comments.go trusts the documentPath argument, so a crafted value causes path traversal. The sources say an attacker can trigger it remotely and that a public exploit exists; they do not say what files can be read or changed.","category":"package","nicknames":[],"who_cares":["wiki-go","self-hosted","go"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or deletes files outside the intended path on the server.","analyst_note":"Confirm from the NVD entry or the upstream commit whether the traversal allows reads, writes, or only deletions, and whether authentication is required.","how_to_check":"- Run `wiki-go --version` or check the project's release tag; versions up to `1.9.1` are affected.\n- Check whether the comment deletion endpoint is reachable from the internet.\n- Review the file internal/comments/comments.go for the DeleteComment function and whether documentPath is validated.","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Teams running self-hosted wiki-go at version 1.9.1 or earlier that expose the comment deletion handler. The sources do not say which deployment settings or roles are required beyond remote reachability. Installations already on 1.9.2 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":3454,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114377':16A,19A '-2026':15A,18A '1.9.1':37B,95C '1.9.2':143C '224ef2a11facddef6b3a3c1f0a69156d1e574a33':154C 'advis':157C 'affect':96C,161C 'argument':46B,118C 'attack':10A,58B,125C 'caus':51B 'chang':79B 'comment':4A,111C 'compon':110C,162C 'craft':49B 'cve':14A,17A 'delet':5A,112C 'deletecom':39B,103C 'detect':85C 'disclos':134C 'documentpath':45B,119C 'exist':68B 'exploit':67B,131C 'file':13A,74B,106C 'function':40B,102C 'go':3A,20B,27B,34B,92C 'handler':113C 'host':24B 'identifi':149C 'initi':128C 'internal/comments/comments.go':42B,107C 'issu':99C,147C 'lead':120C 'leomoon':30B,88C 'leomoon-studio':29B,87C 'let':8A 'manipul':115C 'may':126C,137C 'packag':21B 'patch':152C 'path':6A,52B,122C 'public':66B,135C 'reach':11A 'read':77B 'remot':9A,62B,129C 'resolv':145C 'say':56B,72B 'secur':81C 'self':23B 'self-host':22B 'sourc':55B 'studio':31B,89C 'travers':7A,53B,123C 'trigger':60B 'trust':43B 'upgrad':140C,159C 'use':139C 'valu':50B 'version':142C 'vulner':82C 'wiki':2A,26B,33B,91C 'wiki-go':1A,25B,32B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted wiki-go at version 1.9.1 or earlier that expose the comment deletion handler. The sources do not say which deployment settings or roles are required beyond remote reachability. Installations already on 1.9.2 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T21:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114377","severity":null,"published_at":"2026-10-21T21:17:57+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114377","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114377","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}