Path Traversal in Requarks Wiki
CVE-2020-15236
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit 084dcd69d1591586ee4752101e675d5f0ac6dcdc fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any directory traversal (e.g. `..` and `.`) sequences as well as invalid filesystem characters from the path. As a workaround, disable any storage module with local asset caching capabilities such as Local File System and Git.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.018 (77.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Requarks Wiki — versions >= 2.5.80, < 2.5.151
- Requarks Wiki.js
Weakness classification (CWE)
References
- github.com/Requarks/wiki/security/advisories/GHSA-whpv-5xg2-w527 (Third Party Advisory)
- github.com/Requarks/wiki/commit/084dcd69d1591586ee4752101e675d5f0ac6dcdc (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15236?
- CVE-2020-15236 is a high-severity vulnerability in Requarks Wiki, classified under Path Traversal. CVSS score: 8.6/10. Published 2020-10-05.
- How severe is CVE-2020-15236?
- High severity. CVSS v3 base score is 8.6 out of 10.