# CVE-2026-92775: Wiki.js Image Prefetch server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-92775-wiki-js-image-prefetch-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92775 · Severity: medium · CVSS 6.5 · Published 2026-09-16

Wiki.js is an open-source wiki application. A flaw in its Image Prefetch feature allows attackers with page editing permissions to inject malicious image tags that cause the server to request arbitrary URLs, including internal services and cloud metadata endpoints. The server's responses are returned to the attacker, potentially exposing sensitive internal information or enabling reconnaissance of the infrastructure.

Technologies: [Requarks Wiki.js](https://junglewise.ai/threats/technologies/wiki-js). Vendors: [Requarks](https://junglewise.ai/threats/vendors/requarks).

## Quick answers

**Is CVE-2026-92775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92775 being exploited in the wild.

**How severe is CVE-2026-92775?** Medium severity, with a CVSS score of 6.5, published 16 September 2026.

**Which products and versions are affected?** Requarks Wiki.js through 2.5.314.

**Is there a fix for CVE-2026-92775?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92775 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92775?** Check whether you run Requarks Wiki.js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Wiki.js through version 2.5.314 contains a server-side request forgery (SSRF) vulnerability in the Image Prefetch renderer component. The vulnerability stems from missing protocol, host, and address validation when the renderer fetches image sources specified in img elements with the prefetch-candidate class. Attackers with page editing permissions can inject malicious img tags to make the server perform HTTP requests to arbitrary URLs, including internal services, private IP ranges, and cloud metadata endpoints (e.g., AWS IMDSv2). Responses from these requests are returned to the attacker. A patch is available in versions after 2.5.314.

## Affected products

- Requarks Wiki.js through 2.5.314

## Timeline

- 2026-09-16: disclosed

## References

- [https://github.com/geo-chen/oss/blob/main/wiki.md](https://github.com/geo-chen/oss/blob/main/wiki.md)
- [https://github.com/requarks/wiki](https://github.com/requarks/wiki)

## Related threats

- [Wiki.js path permission bypass in page rule engine](https://junglewise.ai/threats/cve-2026-92776-wiki-js-path-permission-bypass-in-page-rule-engine)
- [Wiki.js authorization bypass in GraphQL resolvers via tag omission](https://junglewise.ai/threats/cve-2026-92774-wiki-js-authorization-bypass-in-graphql-resolvers-via-tag)
- [Requarks Wiki.js privilege escalation in users.update GraphQL mutation](https://junglewise.ai/threats/cve-2026-44224-requarks-wiki-js-privilege-escalation-in-users-update-graphql)
- [Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result…](https://junglewise.ai/threats/cve-2025-56643-requarks-wiki-js-2-5-307-does-not-properly-revoke-or-invalidate)