Login Request a demo
Medium severity · published Oct 21, 2026
CVE-2026-114375
leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
New
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
wiki-go · leomoon-studios
1.9.0; 1.9.1 · source: vendor
Affected product
WI
wiki-go
leomoon-studios
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114375
github.com
https://github.com/leomoon-studios/wiki-go/
github.com
https://github.com/leomoon-studios/wiki-go/commit/81cd12e248314a52605f0f39718c8a76272eac29
github.com
https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2
github.com
https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-xg75-vx57-m5mx
vuldb.com
https://vuldb.com/cve/CVE-2026-114375
vuldb.com
https://vuldb.com/submit/1019389
More from wiki-go
6.3
CVE-2026-114376
leomoon-studios wiki-go API editor.go SourceHandler path traversal
4.3
CVE-2026-114374
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
3.8
CVE-2026-114377
leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal