---
id: CVE-2026-92775
title: >-
  Wiki.js through 2.5.314 contains a server-side request forgery vulnerability
  in the Image Prefetch renderer that fetches arbitrary URLs without protocol,
  host, or address validation
summary: >-
  Wiki.js through 2.5.314 contains a server-side request forgery vulnerability
  in the Image Prefetch renderer that fetches arbitrary URLs without protocol,
  host, or address validation. Attackers with page editing permissions can
  inject img…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: requarks
product: Wiki.js
affected:
  - Wiki.js <= 2.5.314
published: '2026-09-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:22.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92775'
references:
  - url: >-
      https://github.com/geo-chen/oss/blob/main/wiki.md#finding-2-server-side-request-forgery-via-the-image-prefetch-renderer-no-urlhost-validation-on-fetched-image-src
    label: disclosure@vulncheck.com
  - url: 'https://github.com/requarks/wiki'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/requarks/wiki/blob/v2.5.314/server/modules/rendering/html-image-prefetch/renderer.js#L1-L21
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-server-side-request-forgery-via-image-prefetch
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00415
epssPercentile: 0.33042
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T15:48:47.121614Z'
ingestedAt: '2026-09-16T21:05:36.894Z'
---

## Overview

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.