EUVD-2026-64177Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable rename API requires only editor login (PR:L); moving the database causes full confidentiality, integrity, and availability loss within the application scope.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process.
AnalysisAI
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the server process into a page's public asset directory, making it downloadable over HTTP. All releases from 0.3.0 through 0.10.0 (CPE: cpe:2.3:a:perber:leafwiki:*:*:*:*:*:*:*:*) are affected; version 0.10.1 contains the fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid LeafWiki account with editor-level permissions - PR:L in CVSS terms. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H correctly characterizes the core mechanics: network-reachable, no special conditions, editor-level credentials only, no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a legitimate LeafWiki editor account uses the asset rename API to supply a traversal path (e.g., '../../app.db') as the source and a valid page asset name as the destination. The server moves the application database into that page's asset folder, and the attacker retrieves it via a standard HTTP GET to the asset URL - no elevated privileges, no server-side code execution, and no additional tooling required. … |
| Remediation | The primary fix is to upgrade LeafWiki to version 0.10.1 or later, which resolves the path traversal in the asset rename function; the vendor advisory is at https://github.com/perber/leafwiki/security/advisories/GHSA-g2wp-jm5c-jqfj. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all LeafWiki installations running versions 0.3.0-0.10.0 in your environment and prioritize those supporting multi-user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in LeafWiki versions 0.1.0 through 0.10.0 allows any authenticated user to elevate their own accoun
Uncontrolled ZIP extraction in LeafWiki 0.10.0 through 0.12.0 allows any authenticated Editor or Admin to exhaust server
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScri
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today