CVE-2026-114377 leomoon-studios CVE debrief

Who should care

Administrators and users of wiki-go instances, especially those with publicly accessible instances, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-114377 is a medium-severity path traversal vulnerability in leomoon-studios wiki-go that can be exploited remotely. Defenders should prioritize patching to version 1.9.2 or later, restrict access to the comment deletion handler, and monitor for potential exploitation attempts. The vulnerability's impact is limited by the lack of information about widespread exploitation or specific attack scenarios.

• Potential unauthorized access to sensitive files
• Possible data breaches or modifications
• Need for verification of instance exposure and patching
• Potential for remote exploitation

Technical summary

The DeleteComment function in leomoon-studios wiki-go up to version 1.9.1 is vulnerable to path traversal attacks. The function does not properly sanitize the documentPath argument, allowing attackers to manipulate file paths and potentially access sensitive files. The vulnerability can be exploited remotely, and defenders should prioritize patching to version 1.9.2 or later, restrict access to the comment deletion handler, and monitor for potential exploitation attempts. The CVE record and source item provide details about the vulnerability, its impact, and potential mitigations.

Defensive priority

Medium priority for wiki-go users, especially those with publicly accessible instances.

Recommended defensive actions

• Upgrade wiki-go to version 1.9.2 or later
• Review and restrict access to the comment deletion handler
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details about the vulnerability, its impact, and potential mitigations. However, there is limited information about the vulnerability's exploitation in the wild or specific attack scenarios.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.