CVE-2026-92775CWE-918ssrf

CVE-2026-92775

Medium · published September 17, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-17T01:17Z
References (4)
https://github.com/geo-chen/oss/blob/main/wiki.md#finding-2-server-side-request-forgery-via-the-image-prefetch-renderer-no-urlhost-validation-on-fetched-image-src · [email protected]https://github.com/requarks/wiki · [email protected]https://github.com/requarks/wiki/blob/v2.5.314/server/modules/rendering/html-image-prefetch/renderer.js#L1-L21 · [email protected]https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-server-side-request-forgery-via-image-prefetch · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
    cvelistv5