CVE-2026-114374 Details
Description
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
A server-side request forgery (SSRF) vulnerability has been identified in LeoMoon Wiki-Go versions through 1.9.1. The issue resides in the metadata fetching endpoint, which fails to properly validate URLs before making outbound requests. This allows low-privileged users to manipulate the server into fetching internal or private network resources, as well as cloud metadata, potentially leading to unauthorized information disclosure or internal service enumeration.
Users are advised to upgrade to LeoMoon Wiki-Go version 1.9.2, which addresses this vulnerability by implementing proper URL validation and blocking requests to private, loopback, link-local, and cloud metadata destinations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leomoon-studios/wiki-go/ | [email protected] | ProductSource CodeVendor |
| https://github.com/leomoon-studios/wiki-go/commit/25498ebf5c012b870967e38eec2a1e5133fa1a83 | [email protected] | Source CodeVendor |
| https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2 | [email protected] | Release NotesVendor |
| https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-7q4p-98g4-pwp7 | [email protected] | AdvisoryExploitRemedyVendor |
| https://vuldb.com/cve/CVE-2026-114374 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1019388 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/424731 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/424731/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| leomoon-studios wiki-go | <= 1.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |