Read the docs
TI-2020-12044 Aliases CVE-2020-15274

Stored XSS via search result in Wiki.js

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results.

Why it matters now

EPSS 0.00765 55th percentileScored 2026-11-07
Fix Fixed wiki.js (Requarks): 2.5.162

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Requarkswiki.jsbefore 2.5.1622.5.162Patch availableCNA
  • wiki.js VendorRequarks Affected before 2.5.162 Fixed in 2.5.162 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:*before 2.5.162VulnerableRequarks
  • cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:* Versions before 2.5.162 Vulnerable ·Requarks

Remediation

  • Fix · CNA wiki.js (Requarks) Fixed in 2.5.162

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15274

References

Patch 2

Advisory 1

  • TI-2026-32203 Wiki.js: Privilege Escalation via Missing Group Validation in users.update CVSS 4.0HIGH 8.6
  • TI-2021-07999 Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor CVSS 3.1MEDIUM 5.4
  • TI-2025-35387 Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a… CVSS 3.1CRITICAL 9.1
  • TI-2020-12008 Directory Traversal in Wiki.js CVSS 3.1HIGH 8.6
  • TI-2022-07706 Improper write access check in Requarks/wiki CVSS 3.1HIGH 8.1
  • TI-2021-19662 Stored XSS in non-image uploads in Requarks/wiki CVSS 3.1HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences