Skip to content
OpenAdvisories

Product · requarks

Wiki.js

5 known vulnerabilities.

Wiki.js at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 3 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202630
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 8.1
    CVE-2026-92776

    Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

    Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching pr…

    requarks Wiki.js
  • Medium 6.5
    CVE-2026-92775

    Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch

    Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the pre…

    requarks Wiki.js
  • Medium 4.3
    CVE-2026-92774

    Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

    Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metad…

    requarks Wiki.js
  • Medium 5.8
    CVE-2020-15274

    Stored XSS via search result in Wiki.js

    In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit…

    requarks Wiki.js
  • Medium 6.9
    CVE-2020-11051

    XSS in Wiki.js

    In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the M…

    requarks Wiki.js