Requarks Wiki vulnerabilities

CVE-2026-44224 [HIGH] CWE-269 CVE-2026-44224: Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL muta Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's arguments straight to the model without any ownership check or restriction on which groups can

CVE-2021-43800 [HIGH] CWE-22 CVE-2021-43800: Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wik Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only pos

CVE-2020-15236 [HIGH] CWE-22 CVE-2020-15236: In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible when a storage module implementing local as

CVE-2024-28865 [HIGH] CWE-1333 Denial of service via regular expression Denial of service via regular expression ### Impact All historical installations of django-wiki are vulnerable to maliciously crafted article content, that can cause severe use of server CPU through a regular expression loop. ### Patches ### Workarounds Close off access to create and edit articles by anonymous users. ### References _Are there any links users can visit to find out more?_

CVE-2024-34710 [HIGH] CWE-1336 CVE-2024-34710: Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could a Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload

CVE-2022-23654 [MEDIUM] CWE-287 CVE-2022-23654: Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actu

CVE-2021-43855 [MEDIUM] CWE-79 CVE-2021-43855: Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-si Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript wh

CVE-2021-43856 [MEDIUM] CWE-79 CVE-2021-43856: Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-si Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser (e.g. XML files), a malicious Wiki.js user may stage a sto

CVE-2021-43842 [MEDIUM] CWE-79 CVE-2021-43842: Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5.257 and earlier are vulnerable to store Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5.257 and earlier are vulnerable to stored cross-site scripting through a SVG file upload. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other

CVE-2021-25993 [MEDIUM] CWE-79 CVE-2021-25993: In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, wh In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.

CVE-2021-21383 [MEDIUM] CWE-79 CVE-2021-21383: Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to st Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content injection even though it is contained within a `` element. By creating a crafted wiki page,

CVE-2021-25986 [MEDIUM] CWE-79 Cross-site Scripting in django-wiki Cross-site Scripting in django-wiki In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.

CVE-2024-45298 [MEDIUM] CWE-670 CVE-2024-45298: Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. To my shock, not only did it let me reset my password, but after resetting my password I can