Executive brief
Wiki.js is an open-source wiki application. A flaw in its Image Prefetch feature allows attackers with page editing permissions to inject malicious image tags that cause the server to request arbitrary URLs, including internal services and cloud metadata endpoints. The server's responses are returned to the attacker, potentially exposing sensitive internal information or enabling reconnaissance of the infrastructure.
Technical details
Wiki.js through version 2.5.314 contains a server-side request forgery (SSRF) vulnerability in the Image Prefetch renderer component. The vulnerability stems from missing protocol, host, and address validation when the renderer fetches image sources specified in img elements with the prefetch-candidate class. Attackers with page editing permissions can inject malicious img tags to make the server perform HTTP requests to arbitrary URLs, including internal services, private IP ranges, and cloud metadata endpoints (e.g., AWS IMDSv2). Responses from these requests are returned to the attacker. A patch is available in versions after 2.5.314.
Affected products
- Requarks Wiki.js through 2.5.314
Timeline
- 2026-09-16: disclosed