CyberRota Analysis
AI-GeneratedWiki.js versions up to 2.5.314 are vulnerable due to inadequate path separator validation in START and END page rules, enabling unauthorized access to pages that share a prefix with authorized folders. This flaw allows users with folder access to read and modify unrelated pages, effectively bypassing access controls. Organizations using affected versions should prioritize remediation to prevent potential data exposure and unauthorized modifications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.