Description
Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_confirm
https://github.com/Linbreux/wikmd/security/advisories/GHSA-w4cf-92x9-v8w2
Patch, Third Party Advisory x_refsource_misc
https://github.com/Linbreux/wikmd/commit/8d1f94ec86b5b6c3df8ef10051facfb511a78450
Scores
CVSS v3
7.5
EPSS
0.0044
EPSS Percentile
63.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
CWE-23
Status
published
Products (1)
wikmd_project/wikmd
< 1.7.1
Published
Sep 07, 2022
Tracked Since
Feb 18, 2026