CVE-2026-92775
Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 16, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 16, 2026
Description
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
Wiki.jsrequarks |
|
References
- Researcher write-up, finding 2technical-descriptionexploit
- prefetch fetches the src attribute unvalidated and embeds the responsetechnical-description
- https://github.com/requarks/wikiproduct
- VulnCheck Advisory: Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetchthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.