CVE-2026-92775 requarks CVE debrief

Who should care

Wiki.js administrators, defenders, and security teams should assess exposure and prioritize patching affected systems. They should also review and update incident response plans, monitor server requests for suspicious activity, and restrict page editing permissions to trusted users. Additionally, they should verify affected versions and remediation steps from official sources and consider compensating controls for exposed systems.

Why it matters

CVE-2026-92775 is a high-severity server-side request forgery vulnerability in Wiki.js that allows attackers to make arbitrary requests to internal services and cloud metadata endpoints. Defenders should prioritize verifying and patching affected systems, restricting page editing permissions, and monitoring server requests for suspicious activity.

• Potential unauthorized access to internal services
• Possible exposure of cloud metadata
• Required verification of affected versions and remediation steps
• Need for monitoring server requests for suspicious activity

Technical summary

CVE-2026-92775 is a server-side request forgery vulnerability in the Image Prefetch renderer of Wiki.js through 2.5.314. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. Defenders should prioritize verifying and patching affected systems, restricting page editing permissions, and monitoring server requests for suspicious activity.

Defensive priority

Wiki.js administrators and defenders should prioritize verifying and patching affected systems

Recommended defensive actions

• Verify and apply patches for Wiki.js 2.5.314
• Restrict page editing permissions to trusted users
• Monitor server requests for suspicious activity
• Review and update incident response plans
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the server-side request forgery vulnerability in Wiki.js through 2.5.314. However, the exact affected versions and remediation steps require verification from the official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.