CV E-202 6-927 75: Wik i.js Imag e Prefet ch SSR F Vulnerabilit y

CVE-2026-92775 Overview

CVE-2026-92775 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Wiki.js through version 2.5.314. The flaw resides in the Image Prefetch renderer, which fetches arbitrary URLs without validating the protocol, host, or destination address. Attackers holding page editing permissions can inject img elements carrying the prefetch-candidate class. The Wiki.js server then issues outbound requests to attacker-controlled targets and returns the responses. This behavior allows adversaries to reach internal services and cloud metadata endpoints from the vulnerable server.

Critical Impact
Authenticated editors can coerce the Wiki.js backend into fetching internal URLs and cloud instance metadata, exposing credentials, tokens, and internal network resources to the attacker.

Affected Products

Wiki.js (Requarks Wiki) versions through 2.5.314
Deployments using the html-image-prefetch rendering module
Instances allowing page editing for non-administrator accounts

Discovery Timeline

2026-09-16 - CVE-2026-92775 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92775

Vulnerability Analysis

Wiki.js includes a rendering module named html-image-prefetch that scans rendered pages for image elements bearing the prefetch-candidate class. The renderer fetches the referenced URL server-side, presumably to cache or preprocess images. The implementation in server/modules/rendering/html-image-prefetch/renderer.js performs no validation on the target URL's scheme, hostname, or resolved IP address.

As a result, an authenticated user with page editing rights can supply URLs pointing to loopback addresses, RFC 1918 private ranges, link-local addresses, or cloud metadata services. The server retrieves the resource and returns the response body to the attacker through the rendered page. This converts a benign content feature into an authenticated SSRF primitive.

Root Cause

The root cause is missing input validation on user-controlled URLs before initiating outbound HTTP requests. The renderer trusts the src attribute of any img element tagged with the prefetch-candidate class. There is no allowlist of hosts, no blocklist of internal address ranges, and no restriction on URL scheme. This matches the pattern described by CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires authenticated access with page editing permissions, which Wiki.js commonly grants to standard editor roles. An attacker crafts wiki page content containing an img element with class="prefetch-candidate" and a src attribute pointing to a sensitive internal URL. Common targets include http://169.254.169.254/latest/meta-data/ on AWS, the Azure Instance Metadata Service at http://169.254.169.254/metadata/instance, and internal admin interfaces on 127.0.0.1 or private network ranges. When the page renders, the Wiki.js server issues the request and the response is exposed to the attacker.

Technical details are documented in the GitHub SSRF Finding Guide and the VulnCheck Advisory on Wiki.js. The vulnerable code is visible in the GitHub Renderer Code Snippet.

Detection Methods for CVE-2026-92775

Indicators of Compromise

Outbound HTTP requests from the Wiki.js host to 169.254.169.254, 127.0.0.1, or RFC 1918 addresses that do not match legitimate integration traffic
Wiki pages containing img elements with class="prefetch-candidate" and src values referencing internal hostnames, IP literals, or non-HTTPS schemes
Access log entries on internal services showing the Wiki.js server as the source of unexpected GET requests
Cloud metadata service access logs showing requests originating from the Wiki.js instance role

Detection Strategies

Inspect stored page content and revisions for prefetch-candidate class usage tied to suspicious URLs
Monitor egress network traffic from the Wiki.js server for connections to metadata endpoints and private ranges
Correlate page edit events in Wiki.js audit logs with subsequent anomalous outbound requests from the server

Monitoring Recommendations

Enable verbose HTTP client logging within the Wiki.js runtime to capture all URLs fetched by the prefetch renderer
Forward network flow logs and cloud metadata access logs to a centralized analytics platform for correlation
Alert on any request from application servers to 169.254.169.254 that is not part of an approved instance-role workflow

How to Mitigate CVE-2026-92775

Immediate Actions Required

Restrict page editing permissions to trusted users until a patched release is deployed
Disable or unload the html-image-prefetch rendering module in Wiki.js administrative settings
Apply strict egress network controls that block the Wiki.js server from reaching cloud metadata endpoints and internal management interfaces
Rotate any credentials, tokens, or instance-role secrets that may have been exposed through metadata access

Patch Information

No fixed version is identified in the enriched CVE data at the time of publication. Wiki.js users should monitor the Requarks Wiki GitHub repository and the VulnCheck Advisory on Wiki.js for release announcements addressing the Image Prefetch renderer.

Workarounds

Enforce IMDSv2 on AWS instances so that metadata requests require a session token, reducing the value of blind SSRF
Deploy an egress proxy or network policy that denies outbound requests from Wiki.js to link-local, loopback, and private address ranges
Sanitize wiki content on ingest to strip the prefetch-candidate class from user-submitted img elements

bash

# Example egress restriction using iptables to block metadata service access
iptables -A OUTPUT -m owner --uid-owner wiki -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner wiki -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner wiki -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner wiki -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner wiki -d 192.168.0.0/16 -j REJECT