CVE-2022-36081: Wikmd vulnerable to Local File Enumeration when accessing /list

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-07 · updated 2026-06-17
Weakness: CWE-22

Description

Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue.

Affected products

Linbreux wikmd: before 1.7.1 — fixed in 1.7.1

How to fix

Upgrade to a fixed version: Linbreux wikmd 1.7.1. Check the vendor advisory for mitigations.

References

https://github.com/Linbreux/wikmd/commit/8d1f94ec86b5b6c3df8ef10051facfb511a78450
https://github.com/Linbreux/wikmd/security/advisories/GHSA-w4cf-92x9-v8w2
https://github.com/Linbreux/wikmd/commit/8d1f94ec86b5b6c3df8ef10051facfb511a78450
https://github.com/Linbreux/wikmd/security/advisories/GHSA-w4cf-92x9-v8w2

Get alerted when CVE-2022-36081 or the next vulnerability affects your stack