Vulnerability · Published Oct 21, 2026 · Assigned by VulDB
CVE-2026-114377leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal
Low 3.8
In plain English
A low-severity path traversal in wiki-go from leomoon-studios. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.9.2 can resolve this issue. The identifier of the patch is 224ef2a11facddef6b3a3c1f0a69156d1e574a33. It is advisable to upgrade the affected component.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| leomoon-studios | wiki-go | 1.9.01.9.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-424734 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal vdb-entry, technical-description
- VDB-424734 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-114377 | CVE Analysis and Report third-party-advisory
- Submit #1019399 | leomoon-studios wiki-go <= 1.9.1 Path Traversal third-party-advisory
- https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-g86r-58wp-4v86 exploit
- https://github.com/leomoon-studios/wiki-go/commit/224ef2a11facddef6b3a3c1f0a69156d1e574a33 patch
- https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2 patch
- https://github.com/leomoon-studios/wiki-go/ product