CVE-2026-114374: leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadataapi.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
leomoon-studios/wiki-goto a version that resolves this vulnerability.Fixed in 1.9.2Patch 25498ebf5c012b870967e38eec2a1e5133fa1a83
Event History
Frequently Asked Questions
Which deployments are affected?
leomoon-studios wiki-go versions up to and including 1.9.1 are affected. Version 1.9.2 fixes the issue.
What access does an attacker need to exploit this?
The attack can be launched remotely, but the vector specifies low privileges are required. No user interaction is required.
Is exploit code available?
Yes. The exploit is publicly available and may be used.
What should teams do if they are vulnerable?
Upgrade wiki-go to version 1.9.2. The referenced patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83.