Description
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| requarks | Wiki.js | ≤ 2.5.314 | — |
References
- Researcher write-up, finding 3 technical-description exploit
- START and END matchers use _.startsWith and _.endsWith with no boundary check technical-description
- https://github.com/requarks/wiki product
- VulnCheck Advisory: Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass third-party-advisory