CVE-2020-15236

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit 084dcd69d1591586ee4752101e675d5f0ac6dcdc fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any directory traversal (e.g. `..` and `.`) sequences as well as invalid filesystem characters from the path. As a workaround, disable any storage module with local asset caching capabilities such as Local File System and Git.

• CWE-22

• https://github.com/Requarks/wiki/commit/084dcd69d1591586ee4752101e675d5f0ac6dcdcPatch, Third Party Advisory
• https://github.com/Requarks/wiki/security/advisories/GHSA-whpv-5xg2-w527Third Party Advisory
• https://github.com/Requarks/wiki/commit/084dcd69d1591586ee4752101e675d5f0ac6dcdcPatch, Third Party Advisory
• https://github.com/Requarks/wiki/security/advisories/GHSA-whpv-5xg2-w527Third Party Advisory

Published

Oct 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15230Vapor is a web framework for Swift. In Vapor before version …6.5
• CVE-2020-15231In mapfish-print before version 3.24, a user can use the JSO…6.1
• CVE-2020-15232In mapfish-print before version 3.24, a user can do to an XM…9.1
• CVE-2020-15233ORY Fosite is a security first OAuth2 & OpenID Connect frame…4.8
• CVE-2020-15234ORY Fosite is a security first OAuth2 & OpenID Connect frame…4.8
• CVE-2020-15235In RACTF before commit f3dc89b, unauthenticated users are ab…7.5
• CVE-2020-15237In Shrine before version 3.3.0, when using the `derivation_e…5.9
• CVE-2020-15238Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4…7
• CVE-2020-15239In xmpp-http-upload before version 0.4.0, when the GET metho…3.5
• CVE-2020-1524An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15240omniauth-auth0 (rubygems) versions >= 2.3.0 and < 2.4.1 impr…9.1
• CVE-2020-15241TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versi…6.1