EUVD-2026-66212
GHSA-vx6x-47wx-xjjj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Editor role required (PR:L); no confidentiality or integrity impact; availability is high due to unbounded storage exhaustion.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded archive is bounded and the size it expands to is not. The import route that reaches this code requires the Editor or Admin role, and the upload itself is capped at 500 MiB compressed. Because a ZIP entry can compress at a very high ratio, an archive well inside that cap can expand to hundreds of gigabytes as it is written out. The extraction directory defaults to a location under the operating system temporary directory, so the written data consumes the disk backing that path, which on a tmpfs-backed temporary directory is memory. A user holding the Editor role can therefore exhaust the storage the service depends on and keep it from serving, using far more resource than the upload limit alone would permit.
AnalysisAI
Uncontrolled ZIP extraction in LeafWiki 0.10.0 through 0.12.0 allows any authenticated Editor or Admin to exhaust server disk or memory by uploading a crafted ZIP bomb via the import route. The vulnerable function ZipExtractor.ExtractToDir uses Go's io.Copy without a decompressed-size limit, so a maximally compressed archive well inside the 500 MiB upload cap can expand to hundreds of gigabytes on disk - or into RAM when the OS temporary directory is tmpfs-backed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid LeafWiki account assigned the Editor or Admin role; unauthenticated or Viewer-role access to the import endpoint is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 7.1) accurately characterises the threat: network-reachable, low-complexity, requiring only a low-privileged (Editor) account, producing high availability impact with no confidentiality or integrity consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Editor logs into a LeafWiki instance, crafts a single-file ZIP archive with a high-ratio deflate payload (e.g., a multi-gigabyte sequence of null bytes compressed to well under 500 MiB), and submits it to the import endpoint. LeafWiki's extractor calls io.Copy with no size limit, streaming the decompressed output into the OS temporary directory until the backing storage - potentially RAM via tmpfs - is exhausted, causing the LeafWiki process and potentially the host to become unable to write any new data and denying service to all users. |
| Remediation | Upgrade to LeafWiki v0.12.1, which the release notes explicitly confirm adds 'size caps on zip extraction during import/restore.' The patched release is available at https://github.com/perber/leafwiki/releases/tag/v0.12.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable the ZIP import functionality in affected LeafWiki instances unless operationally critical; if disabled, notify users and document the change. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the ser
Privilege escalation in LeafWiki versions 0.1.0 through 0.10.0 allows any authenticated user to elevate their own accoun
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScri
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today