CVE-2020-15236 Directory Traversal in Wiki.js
Attackers can read arbitrary files on the server via directory traversal when local asset caching storage modules are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15236?
CVE-2020-15236 is a high-severity path traversal vulnerability in Requarks wiki, published on 5 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit 084dcd69d1591586ee4752101e675d5f0ac6dcdc fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any directory traversal (e.g. `..` and `.`) sequences as well as invalid filesystem characters from the path. As a workaround, disable any storage module with local asset caching capabilities such as Local File System and Git.
Weakness: CWE-22
Which versions are affected by CVE-2020-15236?
It affects 1 product.
Products include Requarks Wiki.js.
How do I fix CVE-2020-15236?
No fix has been published for CVE-2020-15236 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-15236 being exploited?
There is no known exploitation of CVE-2020-15236 in the wild and no public exploit code.
Other vulnerabilities in Requarks wiki
- CVE-2025-56643 Security feature bypass in n/a
- CVE-2026-44224 Wiki.js: Privilege Escalation via Missing Group Validation in users.update
- CVE-2021-43855 Stored XSS via SVG in Requarks/wiki
- CVE-2021-43856 Stored XSS in non-image uploads in Requarks/wiki
- CVE-2022-23654 Improper write access check in Requarks/wiki
Sources
Also known as GHSA-whpv-5xg2-w527.