Internal/handlers/metadata_api.go exposes a fetch‑metadata endpoint that accepts user input. An attacker can manipulate the request to cause the server to forward the request to arbitrary URLs. This server‑side request forgery allows remote entities to retrieve internal resources, exfiltrate data, or perform further attacks within the network. The vulnerability is present in all releases up to 1.9.1; the patch commit 25498ebf5c012b870967e38eec2a1e5133fa1a83 will remove the flaw.

Leomoon‑Studios wiki‑go is affected. Users running any version through 1.9.1 of the application are vulnerable. The release 1.9.2 incorporates the fix and should be used.

With a CVSS score of 5.3 the issue is considered medium severity. EPSS data is not available, but exploitation is public and could be carried out remotely, yielding SSRF capabilities. KEV is not listed, indicating no confirmed exploitation in the wild yet, yet the remote nature and public exploit make the risk non‑negligible.