Wiki.js Directory Traversal Vulnerability in Local Asset Caching Modules

A directory traversal vulnerability has been identified in Wiki.js versions prior to 2.5.151. This issue arises when a storage module with local asset cache fetching is enabled, such as the Local File System or Git modules. Under these conditions, a malicious user could craft a URL that exploits directory traversal, potentially allowing access to any file on the server's file system. This vulnerability could be exacerbated if no web application firewall, like Cloudflare, is in place to strip harmful URLs.

Impact

Exploitation of this vulnerability could lead to unauthorized access and reading of arbitrary files on the server's file system.

Remediation

Users can upgrade to Wiki.js version 2.5.151 or later, where this vulnerability has been patched. As an alternative, any storage module with local asset caching capabilities, such as Local File System or Git, can be disabled.