requarks

10 results · Clear filters · Feed

• High 8.1
  CVE-2026-92776

  Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

  Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching pr…

  requarks Wiki.js
  Sep 16, 2026
• High 8.6
  CVE-2026-44224

  Wiki.js: Privilege Escalation via Missing Group Validation in users.update

  Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's a…

  requarks wiki
  May 12, 2026
• High 7.1
  CVE-2024-34710

  Wiki.js Stored XSS through Client Side Template Injection

  Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. Th…

  requarks wiki github.com/requarks/wiki Go
  May 20, 2024
• High 7.2
  CVE-2022-1681

  Authentication Bypass Using an Alternate Path or Channel in requarks/wiki

  Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions

  requarks requarks/wiki
  May 12, 2022
• High 8.1
  CVE-2022-23654

  Improper write access check in Requarks/wiki

  Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access co…

  requarks wiki
  Feb 22, 2022
• High 8.2
  CVE-2021-43855

  Stored XSS via SVG in Requarks/wiki

  Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a st…

  requarks wiki
  Dec 27, 2021
• High 8.2
  CVE-2021-43856

  Stored XSS in non-image uploads in Requarks/wiki

  Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute in…

  requarks wiki
  Dec 27, 2021
• High 7.5
  CVE-2021-43800

  Asset directory traversal with some storage modules on Windows

  Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on …

  requarks wiki
  Dec 6, 2021
• High 7.6
  CVE-2021-21383

  XSS in Wiki.js

  Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content…

  requarks wiki
  Mar 18, 2021
• High 8.6
  CVE-2020-15236

  Directory Traversal in Wiki.js

  In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that al…

  requarks wiki
  Oct 5, 2020