Description
A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
Published: 2026-10-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Path Traversal leading to unauthorized file manipulation
Action: Patch Now
AI Analysis

Impact

A path traversal vulnerability exists in the RenameFileHandler of leomoon‑studios wiki‑go. By manipulating the currentPath and newName parameters, an attacker can craft file paths that traverse directories, allowing unauthorized write or overwrite of files on the server. This flaw can be triggered remotely and the public exploit has been released, making it exploitable in production deployments. The weakness is a classic CWE‑22 path traversal bug.

Affected Systems

The issue affects leomoon‑studios wiki‑go versions up to 1.9.1, specifically the Files Rename API component. Upgrading to version 1.9.2, which contains the patch with commit hash 81cd12e248314a52605f0f39718c8a76272eac29, removes the vulnerability.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available, but the vulnerability is publicly exploited and can be reached from a remote attacker. It is not listed in the CISA KEV catalog. The remote exploitation path relies on the exposed API; attackers only need to send a crafted rename request to trigger the path traversal. Given the lack of defensive controls mentioned, the likelihood of successful exploitation is non‑negligible.

Generated by OpenCVE AI on October 22, 2026 at 03:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade leomoon‑studios wiki‑go to version 1.9.2 to apply the fixed RenameFileHandler logic.
  • If an upgrade cannot be performed immediately, restrict the Files Rename API endpoint to trusted administrators only, blocking unauthenticated or public access.
  • Implement input validation or path canonicalization on currentPath and newName parameters to disallow directory traversal characters such as ".." before processing the rename request.

Generated by OpenCVE AI on October 22, 2026 at 03:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file internal/handlers/files.go of the component Files Rename API. Performing a manipulation of the argument currentPath/newName results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.9.2 is able to address this issue. The patch is named 81cd12e248314a52605f0f39718c8a76272eac29. It is recommended to upgrade the affected component.
Title leomoon-studios wiki-go Files Rename API files.go RenameFileHandler path traversal
First Time appeared Leomoon-studios
Leomoon-studios wiki-go
Weaknesses CWE-22
CPEs cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*
Vendors & Products Leomoon-studios
Leomoon-studios wiki-go
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Leomoon-studios Wiki-go
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-23T21:20:14.859Z

Reserved: 2026-10-21T11:11:50.633Z

Link: CVE-2026-114375

cve-icon Vulnrichment

Updated: 2026-10-23T18:00:37.379Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T20:17:26.100

Modified: 2026-10-23T22:16:56.533

Link: CVE-2026-114375

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T03:45:18Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')