CVE-2026-92775

Name of the Vulnerable Software and Affected Versions Wiki.js versions prior to 2.5.315

Description The Image Prefetch renderer allows server-side request forgery, a flaw where the server is tricked into making requests to an unintended location. This occurs because the renderer fetches arbitrary URLs without validating the protocol, host, or address. Users with page editing permissions can inject img elements using the prefetch-candidate class to force the server to request internal services or cloud metadata endpoints, with the resulting responses being returned to the attacker.

Recommendations Update Wiki.js to version 2.5.315 or later.