Server-Side Request Forgery in Wiki.js Affects Multiple Versions
CVE-2026-92775

7.1HIGH

Key Information:

Vendor

Requarks

Status
Wiki.js
Vendor
CVE Published:
16 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-92775?

Wiki.js versions up to 2.5.314 are exposed to a server-side request forgery vulnerability within the Image Prefetch renderer. This issue allows attackers with page editing permissions to exploit the system by injecting img elements featuring the prefetch-candidate class. As a result, arbitrary URLs can be fetched without proper validation of the protocol, host, or address, enabling attackers to access internal services and cloud metadata endpoints, with the responses routed back to them. Immediate action is advised to safeguard against potential exploitation.

Affected Version(s)

Wiki.js 0 <= 2.5.314

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-92775 - Proof of Concept

References

https://github.com/geo-chen/oss/blob/main/wiki.md#finding...
technical-descriptionexploit
https://github.com/requarks/wiki/blob/v2.5.314/server/mod...
technical-description
https://github.com/requarks/wiki
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.