Medium severity · published Oct 21, 2026
CVE-2026-114374
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
wiki-go · leomoon-studios
1.9.0; 1.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114374
github.com
https://github.com/leomoon-studios/wiki-go/
github.com
https://github.com/leomoon-studios/wiki-go/commit/25498ebf5c012b870967e38eec2a1e5133fa1a83
github.com
https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2
github.com
https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-7q4p-98g4-pwp7
vuldb.com
https://vuldb.com/cve/CVE-2026-114374
vuldb.com
https://vuldb.com/submit/1019388
More from wiki-go
6.3
CVE-2026-114376
leomoon-studios wiki-go API editor.go SourceHandler path traversal
6.3
CVE-2026-114375
leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
3.8
CVE-2026-114377
leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal