CVE-2026-92776
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
脆弱性の種類
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
参考情報
- https://github.com/geo-chen/oss/blob/main/wiki.md#finding-3-page-permission-rule-engine-grants-readwrite-access-to-any-page-whose-path-shares-a-literal-prefix-with-an-allowed-path-no-path-segment-boundary-check
- https://github.com/requarks/wiki
- https://github.com/requarks/wiki/blob/v2.5.314/server/core/auth.js#L252-L263
- https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-path-prefix-matching-authorization-bypass
- https://github.com/geo-chen/oss/blob/main/wiki.md#finding-3-page-permission-rule-engine-grants-readwrite-access-to-any-page-whose-path-shares-a-literal-prefix-with-an-allowed-path-no-path-segment-boundary-check