CVE-2026-92775: Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs page editing permissions and must be able to add an img element with the prefetch-candidate class. The vulnerable renderer then fetches the supplied URL from the Wiki.js server.
What systems or data could be exposed?
The server can be induced to request arbitrary URLs, including internal services and cloud metadata endpoints. Responses from those requests are returned to the attacker, so exposure depends on what the Wiki.js server can reach.
Are default deployments affected?
The provided information identifies affected Wiki.js versions through 2.5.314, but it does not state whether Image Prefetch is enabled or reachable in a default configuration.
What can be done if patching is not immediately possible?
Limit page editing permissions to trusted users, since exploitation requires editing access. Restrict the Wiki.js server's network access to internal services and cloud metadata endpoints where possible.