Read the docs
TI-2021-19606 Aliases CVE-2021-43800

Asset directory traversal with some storage modules on Windows

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f3243234852f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git).

Why it matters now

EPSS 0.01796 78th percentileScored 2026-11-07
Fix Fixed wiki (Requarks): 2.5.254

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Requarkswikibefore 2.5.2542.5.254Patch availableCNA
  • wiki VendorRequarks Affected before 2.5.254 Fixed in 2.5.254 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:*before 2.5.245VulnerableRequarks
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:* Versions before 2.5.245 Vulnerable ·Requarks
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA wiki (Requarks) Fixed in 2.5.254

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43800

References

Patch 2

Advisory 1

  • TI-2026-32203 Wiki.js: Privilege Escalation via Missing Group Validation in users.update CVSS 4.0HIGH 8.6
  • TI-2021-07999 Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor CVSS 3.1MEDIUM 5.4
  • TI-2025-35387 Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a… CVSS 3.1CRITICAL 9.1
  • TI-2020-12008 Directory Traversal in Wiki.js CVSS 3.1HIGH 8.6
  • TI-2022-07706 Improper write access check in Requarks/wiki CVSS 3.1HIGH 8.1
  • TI-2021-19662 Stored XSS in non-image uploads in Requarks/wiki CVSS 3.1HIGH 8.2
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences