Technical impact
A path traversal flaw exists in the DeleteComment function of leomoon-studios wiki‑go. By manipulating the documentPath supplied to this endpoint, an attacker can influence the filesystem path and cause deletion of files outside the intended directory. The vulnerability can be triggered from a remote request and has been publicly disclosed, which could allow an adversary to remove arbitrary files on the server hosting the application.
Affected Systems
The vulnerable component is leomoon-studios wiki‑go up to version 1.9.1. Versions 1.9.2 and later contain the fix. The product is controlled by leomoon-studios and is hosted under the cpe:2.3:a:leomoon-studios:wiki-go.
Risk and Exploitability
The CVSS score of 5.1 indicates moderate overall risk, and the lack of an EPSS score is not indicative of low exploit probability by itself. The vulnerability is listed outside of CISA’s KEV catalog. The exploit requires remote access to the DeleteComment endpoint, so an attacker must be able to send crafted requests to the server. Once executed, the flaw can delete files beyond the normal comment directory, potentially compromising application integrity or facilitating further attacks if sensitive configuration files are removed.
