Medium severity6.5NVD Advisory· Published Sep 16, 2026· Updated Sep 24, 2026

CVE-2026-92775

Description

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Requarks/Wikireferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=2.5.314

Patches

Vulnerability mechanics

References

github.com/geo-chen/oss/blob/main/wiki.mdnvd
github.com/requarks/wiki/blob/v2.5.314/server/modules/rendering/html-image-prefetch/renderer.jsnvd
www.vulncheck.com/advisories/wiki-js-through-2.5.314-server-side-request-forgery-via-image-prefetchnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000