← Vulnerability feed

Vulnerability record · CVE-2021-43800 · published 6 December 2021

CVE-2021-43800: Requarks wiki.js path traversal vulnerability

Requarks · Wiki.Js

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f3243234852f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git).

7.5 CVSS 3.1 High EPSS 1.7% · top 23.2% CWE-22 · Path traversal
7.5CVSS 3.1 base score, v2 4.3
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f3243234852f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Requarks/wiki/commit/414033de9dff66a327e3f3243234852f468a9d85 PatchThird Party Advisory
https://github.com/Requarks/wiki/releases/tag/2.5.254 Release NotesThird Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-r363-73gj-6j25 PatchThird Party Advisory
https://github.com/Requarks/wiki/commit/414033de9dff66a327e3f3243234852f468a9d85 PatchThird Party Advisory
https://github.com/Requarks/wiki/releases/tag/2.5.254 Release NotesThird Party Advisory
https://github.com/Requarks/wiki/security/advisories/GHSA-r363-73gj-6j25 PatchThird Party Advisory

Track CVE-2021-43800 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2025-56643Requarks wiki.js insufficient session expiration vulnerabilityRequarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, previously issued tokens remain …EPSS 0.36%8.6CVE-2026-44224Requarks wiki.js improper privilege management vulnerabilityWiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbitrary groups array and applie…EPSS 0.56%7.5CVE-2020-15236Requarks wiki.js path traversal vulnerabilityIn Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching i…EPSS 1.8%7.2CVE-2022-1681Requarks wiki.js authentication bypass via alternate path vulnerabilityAuthentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissionsEPSS 1.9%6.5CVE-2022-23654Requarks wiki.js improper authentication vulnerabilityWiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page o…EPSS 0.72%6.1CVE-2020-4052Requarks wiki.js cross-site scripting vulnerabilityIn Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation…EPSS 0.84%5.4CVE-2021-25993Requarks wiki.js cross-site scripting vulnerabilityIn Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a S…EPSS 0.62%5.4CVE-2021-43855Requarks wiki.js cross-site scripting vulnerabilityWiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a…EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2021-43800), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.