CVE-2026-53528 in LeafWiki
Summary
by MITRE • 08/22/2026
LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
LeafWiki versions 0.3.0 through 0.10.0 contain a critical path traversal vulnerability within its asset rename functionality that allows authenticated users with editor privileges to manipulate file system paths in unintended ways. This flaw stems from insufficient validation of user-supplied input during the renaming process, enabling an attacker to construct malicious file paths that escape the designated asset directory boundaries. By exploiting this weakness, an authorized but potentially untrusted user can move or reference files located outside the intended scope into a page’s accessible asset folder. The core technical failure lies in the application's inability to properly canonicalize and sanitize path components before processing them against the server's file system constraints. This lack of rigorous input validation creates a direct pathway for unauthorized access to sensitive local resources that are otherwise protected by standard directory isolation mechanisms.
The operational impact of this vulnerability is severe, as it effectively bypasses authentication controls regarding specific file types and locations. An attacker can leverage this path traversal to expose critical application data, most notably the LeafWiki database files which often contain user credentials, session tokens, and other sensitive configuration details. Once these files are moved into a publicly accessible asset directory, they become downloadable by any visitor to the wiki, regardless of their authentication status or permission level. This results in a complete compromise of confidentiality for stored data, potentially leading to further attacks such as credential stuffing, account takeover, or deeper infiltration if the database contains additional sensitive information like internal network configurations or personal identifiable information. The ability to read arbitrary files accessible by the LeafWiki server process significantly escalates the risk profile from a simple configuration error to a critical security breach affecting data integrity and availability.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can resolve to unintended directories or files outside the intended scope. Additionally, the exploitation technique maps directly to MITRE ATT&CK tactic TA0001: Initial Access and specifically the sub-technique T1530: Data from Cloud Storage Object or Local File Discovery under Collection techniques, as it involves discovering and exfiltrating sensitive data through improper file system access controls. Understanding these mappings helps in contextualizing the severity within broader security frameworks and ensures that remediation efforts address both the specific code flaw and the underlying architectural weaknesses related to least privilege principles.
To mitigate this vulnerability, operators must immediately update LeafWiki to version 0.10.1 or any subsequent release where the path traversal issue has been resolved through improved input sanitization and strict boundary checks on file operations. In addition to applying the software patch, it is imperative that system administrators enforce least privilege principles by configuring the LeafWiki process to run with minimal filesystem permissions. This involves ensuring the application user account does not have read or write access to sensitive directories such as those containing database files, configuration secrets, or other critical system resources outside of the designated wiki data folders. Restricting editor access to only trusted and vetted users further reduces the attack surface by limiting the number of potential actors who could attempt exploitation until patches are fully deployed across all instances.