The vulnerability is a path traversal flaw in the SaveHandler/SourceHandler of leomoon‑studios wiki‑go, allowing an attacker to supply crafted paths that escape the intended directory boundary. This weakness, mapped to CWE‑22, can lead to reading or writing arbitrary files on the server, enabling data disclosure or modification of critical configuration files. The flaw can be triggered through benign API calls and is exploitable remotely, meaning an attacker need only send a request to the vulnerable endpoint to abuse it.

Versions of leomoon‑studios wiki‑go up to 1.9.1 are affected. The vulnerability was addressed in release 1.9.2 (commit 94f7e73ef8df7c58091d72d77a5e26e9fdad98b8).

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can invoke the path traversal remotely by sending a crafted API request to the SourceHandler endpoint; the exploit is publicly available, meaning that no special privileges are required to launch an attack.