CVE-2026-53529 in LeafWiki
Summary
by MITRE • 08/22/2026
LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With `--public-access` enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
LeafWiki, a self-hosted wiki application, suffered from a stored cross-site scripting vulnerability affecting versions prior to 0.10.2. The core technical flaw resided within the implementation of the search API and its corresponding frontend rendering logic. Specifically, page titles retrieved via the search endpoint were inserted directly into the Document Object Model without adequate sanitization or encoding. This oversight allowed author-controlled content in page titles to be interpreted as raw HTML by the victim's browser rather than being treated as plain text data. The vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation known commonly as Cross-site Scripting XSS.
The exploitation vector required a user with editor or administrator privileges to create or modify a page title containing malicious HTML or JavaScript payloads. Once such a payload was stored in the database, it remained dormant until triggered by another action within the application ecosystem. The trigger mechanism involved any other user performing a search query that matched terms present in the compromised page titles. When the backend returned these results, the frontend would render the unescaped title strings directly into the HTML response body. Consequently, when the victim viewed the search results page, their browser executed the embedded script code contained within the maliciously crafted page title.
The operational impact of this vulnerability is contingent upon the specific deployment configuration and access control settings of the LeafWiki instance. In deployments where public access is enabled via the --public-access flag, unauthenticated visitors could be targeted by these attacks without needing to log in or possess any special permissions within the wiki system. This significantly broadens the attack surface, allowing external attackers who have gained editor privileges on a target site to compromise any visitor viewing search results. In authenticated-only deployments where public access is disabled, the impact is restricted to cross-user XSS against logged-in users who have permission to view the affected pages and whose searches trigger the display of the malicious title in the result list.
The security implications extend beyond simple script execution depending on the context in which the payload operates within the victim's browser session. Successful exploitation could lead to session hijacking, where an attacker steals authentication cookies or tokens associated with the victim’s active LeafWiki session. This would allow the attacker to impersonate legitimate users, potentially escalating privileges if the compromised account holds administrative rights. Furthermore, attackers could use this vector for phishing attacks by redirecting victims to malicious external sites or stealing sensitive information displayed on other pages within the wiki that are accessible during the same browsing session. The persistence of the payload in page titles means a single successful injection can affect numerous users over an extended period until remediation occurs.
This vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based execution via stored XSS payloads. It also relates to T1189 Drive-by Compromise if the payload leads to further malware downloads or exploits in other software components accessed during the session. The root cause is a failure to implement proper output encoding for dynamic content derived from user input before rendering it in an HTML context, which violates fundamental web security principles regarding data separation between code and data.
The issue was resolved in version 0.10.2 by modifying the frontend rendering logic to ensure that author-controlled page titles are properly escaped or encoded so they are not interpreted as raw HTML by the browser. The fix preserves essential functionality such as search result highlighting, demonstrating that security measures can be implemented without degrading user experience. To mitigate this risk in affected environments, administrators must upgrade LeafWiki to version 0.10.2 or later immediately. For organizations unable to patch instantly due to operational constraints, implementing a Web Application Firewall rule to detect and block common XSS patterns in page title fields during creation or modification can provide temporary protection. Additionally, enforcing strict Content Security Policy headers that restrict script execution sources may reduce the impact of successful exploitation by preventing inline scripts from running unless explicitly whitelisted. Regular security audits focusing on input validation and output encoding practices are recommended to prevent similar vulnerabilities in future development cycles.