CVE-2026-114374
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 21, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 21, 2026
Description
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
wiki-goleomoon-studios |
|
References
- VDB-424731 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgeryvdb-entry
- VDB-424731 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-114374 | CVE Analysis and Reportthird-party-advisory
- Submit #1019388 | leomoon-studios wiki-go <= 1.9.1 Server-Side Request Forgerythird-party-advisory
- https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-7q4p-98g4-pwp7exploit
- https://github.com/leomoon-studios/wiki-go/commit/25498ebf5c012b870967e38eec2a1e5133fa1a83patch
- https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2patch
- https://github.com/leomoon-studios/wiki-go/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.