Medium severity · published Oct 21, 2026
CVE-2026-114376
leomoon-studios wiki-go API editor.go SourceHandler path traversal
New
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.9.2 addresses this issue. This patch is called 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8. Upgrading the affected component is advised.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
wiki-go · leomoon-studios
1.9.0; 1.9.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114376
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114376
github.com
https://github.com/leomoon-studios/wiki-go/
github.com
https://github.com/leomoon-studios/wiki-go/commit/94f7e73ef8df7c58091d72d77a5e26e9fdad98b8
github.com
https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2
github.com
https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-wv68-7fq9-834c
vuldb.com
https://vuldb.com/cve/CVE-2026-114376
vuldb.com
https://vuldb.com/submit/1019390
More from wiki-go
6.3
CVE-2026-114375
leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
4.3
CVE-2026-114374
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
3.8
CVE-2026-114377
leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal