Wiki.js through 2.5.314 has a vulnerability where it fails to require path separators when matching START and END page rules. This allows attackers to access pages sharing a prefix with authorized folders. Users with access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls. Wiki.js administrators and users with folder access should assess their expo [truncated]
CVE-2026-92775 is a high-severity server-side request forgery vulnerability in Wiki.js through 2.5.314. The vulnerability allows attackers with page editing permissions to inject img elements with the prefetch-candidate class, making the server request internal services and cloud metadata endpoints, with responses returned to the attacker. Wiki.js administrators and defenders should assess exposure and pr [truncated]
