Wiki.js vulnerabilities
4 known vulnerabilities in Wiki.js from Requarks. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Wiki.js: Incorrect Authorization
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching pre
- 8.8 High severity
wiki: Improper Privilege Management
Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applies it directly to the database with no validation of the group IDs supplied. The resolver passes the caller's ar
- 9.1 Critical severity
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user…
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain valid and can be reused to access the system, even after logout. This behavior affects session integrity and ma
- 7.1 High severity
wiki: Improper Neutralization of Special Elements Used in a Template Engine
Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. Thi