CVE-2026-53528
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
LeafWiki versions 0.3.0 through 0.10.0 have a path traversal vulnerability in the asset rename functionality. An authenticated user with editor permissions could move files accessible to the LeafWiki server process into a page's asset directory, potentially allowing sensitive local files, such as the application database, to become downloadable. Users should update to version 0.10.1 or greater.
Risk Assessment
An attacker could gain access to sensitive system files, potentially leading to data leakage or application integrity compromise.
Recommendation
Upgrade LeafWiki to version 0.10.1 or later. Restrict the LeafWiki process privileges and editor access to trusted users only.
Other vulnerabilities in LeafWiki
See all- CVE-2026-80189Medium
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded archive is bounded and the size it expands to is not. The import route that reaches this code requires the Editor or Admin role, and the upload itself is capped at 500 MiB compressed. Because a ZIP entry can compress at a very high ratio, an archive well inside that cap can expand to hundreds of gigabytes as it is written out. The extraction directory defaults to a location under the operating system temporary directory, so the written data consumes the disk backing that path, which on a tmpfs-backed temporary directory is memory. A user holding the Editor role can therefore exhaust the storage the service depends on and keep it from serving, using far more resource than the upload limit alone would permit.
- CVE-2026-53529Medium
LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With `--public-access` enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.
- CVE-2026-53527High
LeafWiki versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user can change their own role from e.g. 'viewer' to 'admin'. This requires a valid LeafWiki account.
Original NVD description (English source)
LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process.