wiki
3.4.0Wiki.js | Next Generation Open Source Wiki
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 30 advisories2 critical, 10 high, 16 medium, 2 low · Scorecard 5.9/10
- Supported versions
- No scheduleendoflife.date does not track this project
29.3k stars · 3.4k forks · 9 open issues · last release 4 hours ago · data checked 41 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 2 critical, 10 high, 16 medium, 2 low. Check the patched version against the one you run.
- lowGHSA-74gh-jx9m-95qjNov 15, 2026Missing authorization check allows unauthenticated access to image thumbnails
- Affected
- <=3.3.1
- Patched in
- >=3.4.0
- criticalGHSA-jp85-8jq5-9gv6Nov 15, 2026Stored XSS in the map block's marker label escalates any account to administrator
- Affected
- >= 3.0.0, <= 3.3.1
- Patched in
- >=3.4.0
- highGHSA-848h-794v-rmq9Nov 15, 2026Branch-wide page rule bypass by creating a feedback board above protected pages
- Affected
- >= 3.0.0, <= 3.3.1
- Patched in
- >=3.4.0
- mediumGHSA-74j8-43gw-p2prNov 15, 2026Edit suggestion review queue discloses page source the reviewer is not allowed to read
- Affected
- >= 3.0.0, <= 3.3.1
- Patched in
- >=3.4.0
- mediumGHSA-47c8-3859-4ccfNov 15, 2026Asset write authorization bypass through a file name that two sanitizer passes do not agree on
- Affected
- >= 3.0.0, <= 3.3.1
- Patched in
- >=3.4.0
- mediumGHSA-gv55-77xw-q5v3Nov 15, 2026An empty locale makes a reference that every locale-scoped group rule ignores
- Affected
- >= 3.0.0, <= 3.3.1
- Patched in
- >=3.4.0
- mediumGHSA-35c7-6872-jrh6Nov 15, 2026Three page-resolution routes answer about pages that are not live
- Affected
- >= 3.0.0, <= 3.3.1
- Patched in
- >=3.4.0
- mediumGHSA-5539-6c4x-464hNov 15, 2026A glossary term's documentation path reports the title and existence of any page
- Affected
- >= 3.0.0, <= 3.3.1
- Patched in
- >=3.4.0
- mediumGHSA-x6q9-c4vx-rf3gNov 11, 2026Git storage: symlink in a synced repository leads to arbitrary file write into .git and remote code execution
- Affected
- <=3.3.0
- Patched in
- >=3.3.1
- mediumGHSA-pq85-v5r4-w5xjNov 9, 2026Page-move destination authorization bypass moves content into denied branches
- Affected
- =3.2.0
- Patched in
- >=3.3.0
- highGHSA-6m8p-37cv-c4f5Nov 9, 2026Asset write authorization bypass allows overwriting protected files and moving assets into denied folders
- Affected
- =3.2.0
- Patched in
- >=3.3.0
- mediumGHSA-87m5-mch4-5f2qNov 9, 2026Page-creation authorization bypass allows publishing in denied branches
- Affected
- =3.2.0
- Patched in
- >=3.3.0
- mediumGHSA-2rx3-7vrr-h3gvNov 8, 2026Asset rename bypasses destination authorization when only the filename changes
- Affected
- >=3.0.0,<=3.1.1
- Patched in
- >=3.2.0
- lowGHSA-x9r2-wh7w-h4qcNov 8, 2026Potential Site-Scoped Authorization Bypass in Blocks API
- Affected
- >=3.0.0,<=3.1.1
- Patched in
- >=3.2.0
- mediumGHSA-fxw3-8676-67fmNov 8, 2026Page restore bypasses script authorization (write:scripts)
- Affected
- >=3.0.0,<= 3.1.1
- Patched in
- >=3.2.0
- mediumGHSA-p5rv-hmh3-wrv8Nov 6, 2026Folder deletion deletes pages and permanently deletes files without `delete:pages` or `manage:assets`
- Affected
- >= 3.0.0, <= 3.1.0
- Patched in
- 3.1.1
- highGHSA-7mf7-wprw-7fjmNov 6, 2026Folder rename, move and duplicate ignore page rules on descendant pages, exposing content the caller is denied
- Affected
- >= 3.0.0, <= 3.1.0
- Patched in
- 3.1.1
- highGHSA-m4c7-x7x7-3ppwNov 5, 2026Stored XSS via the draw.io block's `server` property (javascript: URL in iframe src)
- Affected
- <=3.0.2
- Patched in
- 3.1.0
- highGHSA-3c74-j8g3-p255Nov 5, 2026Stored XSS in the markdown editor preview and live-note reader (client renders raw HTML without sanitizing)
- Affected
- <=3.0.2
- Patched in
- 3.1.0
- mediumGHSA-jf48-pw92-vgrxNov 5, 2026Unpublished (draft/scheduled) pages disclosed through the tree listing, backlinks/links and tag counts
- Affected
- <=3.0.2
- Patched in
- 3.1.0
- highGHSA-35r7-33j8-ghwgNov 5, 2026Stored XSS via javascript: URL in navigation link target (manage:navigation)
- Affected
- <= 2.5.317
- Patched in
- 3.1.0
- mediumGHSA-f865-6hp9-6w47Nov 2, 2026Deactivation does not revoke live web sessions
- Affected
- 3.0.1
- Patched in
- 3.0.2
- highCVE-2026-120698Sep 21, 2026Root Administrator Takeover, TFA Bypass and Lock out.
- Affected
- <= v2.5.314
- Patched in
- 2.5.315
- highCVE-2026-120697Sep 21, 2026Stored XSS via Vue Slot Directives in Page Content
- Affected
- <2.5.314
- Patched in
- 2.5.315
- criticalCVE-2026-44224Apr 28, 2026Privilege Escalation via Missing Group Validation in `users.update`
- Affected
- <= 2.5.312
- Patched in
- 2.5.313
- highCVE-2024-45298Sep 18, 2024Disabled user can bypass lockout by requesting password reset
- Affected
- 2.5.303
- Patched in
- 2.5.304
- highCVE-2024-34710May 19, 2024Stored XSS through Client Side Template Injection
- Affected
- <=2.5.302
- Patched in
- 2.5.303
- mediumCVE-2022-23654Feb 21, 2022Improper write access check using arbitrary page path
- Affected
- <=2.5.275
- Patched in
- 2.5.276
- mediumCVE-2021-43856Dec 26, 2021Stored XSS in non-image uploads when viewed inline in browser
- Affected
- <2.5.264
- Patched in
- 2.5.264
- mediumCVE-2021-43855Dec 26, 2021Stored XSS via SVG file upload with fake MIME type
- Affected
- <2.5.264
- Patched in
- 2.5.264