LeafWiki CVE-2026-80189

Exploitation requires a valid LeafWiki account assigned the Editor or Admin role; unauthenticated or Viewer-role access to the import endpoint is not possible. The LeafWiki instance must be network-reachable by the attacker. No non-default configuration is required beyond the attacker possessing the Editor credential. The denial-of-service severity is amplified - but not exclusively dependent on - the OS temporary directory being tmpfs-backed, a common Linux default; on persistent-disk-backed temp directories the attack still exhausts disk space but does not consume RAM. Limiting factors are the Editor role requirement (restricting exploitation to credentialed contributors) and the upload interaction, which produces an audit log entry.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 7.1) accurately characterises the threat: network-reachable, low-complexity, requiring only a low-privileged (Editor) account, producing high availability impact with no confidentiality or integrity consequence. The Editor role prerequisite is the sole meaningful exploitation barrier - once an attacker holds that credential the attack requires nothing more than uploading a crafted file. LeafWiki is a niche open-source wiki with limited enterprise deployment, which constrains the population of exposed instances. No CISA KEV listing and no public exploit code are identified, making opportunistic at-scale exploitation unlikely; the realistic threat actor is a malicious or compromised insider or a low-trust wiki contributor. EPSS data was not provided in the input and cannot be cited. The vendor tag 'Information Disclosure' applied to this CVE appears inconsistent with the actual impact (availability-only); analysts should disregard that tag and rely on the CVSS vector and description instead.

An authenticated Editor logs into a LeafWiki instance, crafts a single-file ZIP archive with a high-ratio deflate payload (e.g., a multi-gigabyte sequence of null bytes compressed to well under 500 MiB), and submits it to the import endpoint. LeafWiki's extractor calls io.Copy with no size limit, streaming the decompressed output into the OS temporary directory until the backing storage - potentially RAM via tmpfs - is exhausted, causing the LeafWiki process and potentially the host to become unable to write any new data and denying service to all users.