CVE-2026-114375 Details
Description
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
A path traversal vulnerability has been identified in LeoMoon Wiki-Go versions through 1.9.1, specifically within the Files Rename API. The issue arises in the RenameFileHandler function, located in internal/handlers/files.go. The vulnerability allows an editor role user to manipulate the currentPath and newName arguments, enabling them to traverse directories and move files outside the intended documents directory. This exploitation can be done remotely, and the vulnerability has been publicly disclosed along with a released exploit. The issue has been patched in version 1.9.2.
Users are advised to upgrade to LeoMoon Wiki-Go version 1.9.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leomoon-studios/wiki-go/ | [email protected] | ProductSource CodeVendor |
| https://github.com/leomoon-studios/wiki-go/commit/81cd12e248314a52605f0f39718c8a76272eac29 | [email protected] | Source CodeVendor |
| https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2 | [email protected] | Release NotesVendor |
| https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-xg75-vx57-m5mx | [email protected] | AdvisoryExploitRemedyVendor |
| https://vuldb.com/cve/CVE-2026-114375 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1019389 | [email protected] | Permission Required |
| https://vuldb.com/vuln/424732 | [email protected] | Permission Required |
| https://vuldb.com/vuln/424732/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| leomoon-studios wiki-go | <= 1.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |