CVE-2026-114377 Details
Description
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.
A path traversal vulnerability has been identified in LeoMoon Wiki-Go versions through 1.9.1. The issue resides in the Comment Deletion Handler, specifically within the DeleteComment function in comments.go. The vulnerability allows authenticated administrators to delete arbitrary files on the host filesystem by manipulating the documentPath argument, leading to unauthorized file removals outside the intended directory. This flaw can be exploited remotely.
Users are advised to upgrade to LeoMoon Wiki-Go version 1.9.2, which addresses this vulnerability by implementing proper path sanitization and validation before any file deletion actions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leomoon-studios/wiki-go/ | [email protected] | ProductSource CodeVendor |
| https://github.com/leomoon-studios/wiki-go/commit/224ef2a11facddef6b3a3c1f0a69156d1e574a33 | [email protected] | Source CodeVendor |
| https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2 | [email protected] | Release NotesVendor |
| https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-g86r-58wp-4v86 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-114377 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1019399 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/424734 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/424734/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| leomoon-studios wiki-go | <= 1.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |