SB20261111152 - Multiple vulnerabilities in Wiki.js
Published: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose titles, paths, descriptions, tags and timestamps of unpublished draft or scheduled pages in Wiki.js.
The vulnerability exists due to incorrect authorization in the tree listing, backlinks, links and tag-count endpoints when handling requests for page metadata without enforcing publication-state visibility checks. A remote attacker can query these endpoints for paths accessible through read:pages, including as a guest where public reading is enabled, to obtain metadata about pages that are not live.
The disclosure is limited to page metadata; page bodies are not exposed.
2) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in a page viewer's browser in the wiki's origin, disclose sensitive information, and perform unauthorized actions as the viewer.
The vulnerability exists due to improper neutralization of script-bearing URLs in the Wiki.js block-drawio component and server-side page sanitizer when rendering stored draw.io blocks. A remote user can save <block-drawio server="javascript:alert(document.domain)//"><pre>x</pre></block-drawio> in a page they can edit, causing the unvalidated server value to become an iframe src and execute JavaScript in the wiki's origin when a victim views the page.
Exploitation requires the draw.io block to be enabled, which is the default.
3) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary JavaScript in the wiki origin, steal session tokens, and perform actions as victims, including administrators.
The vulnerability exists due to improper validation of URL schemes in navigation.updateTree and the sidebar component nav-sidebar.vue when storing and rendering navigation link targets. A remote user can use the manage:navigation or manage:system permission to store a link target containing javascript:... and induce a victim to click the sidebar link, executing JavaScript that can read the jwt cookie and take over the victim's session.
The global sidebar displays the malicious link on every page for every viewer, including guests.
Remediation
Install update from vendor's website.