Leafwiki
Monthly
Uncontrolled ZIP extraction in LeafWiki 0.10.0 through 0.12.0 allows any authenticated Editor or Admin to exhaust server disk or memory by uploading a crafted ZIP bomb via the import route. The vulnerable function ZipExtractor.ExtractToDir uses Go's io.Copy without a decompressed-size limit, so a maximally compressed archive well inside the 500 MiB upload cap can expand to hundreds of gigabytes on disk - or into RAM when the OS temporary directory is tmpfs-backed. No public exploit has been identified at time of analysis, though the attack is mechanically simple for any credentialed Editor.
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScript payload in a page title, which executes in any victim's browser when they view search results containing that title. No public exploit identified at time of analysis. The attack surface widens significantly when the `--public-access` flag is enabled, making unauthenticated visitors viable targets; in default authenticated-only deployments, the blast radius is limited to logged-in users. A vendor-released patch is available in version 0.10.2.
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the server process into a page's public asset directory, making it downloadable over HTTP. All releases from 0.3.0 through 0.10.0 (CPE: cpe:2.3:a:perber:leafwiki:*:*:*:*:*:*:*:*) are affected; version 0.10.1 contains the fix. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low exploitation complexity and high-impact outcome - including potential exposure of the application database - make prompt patching urgent for any multi-user deployment.
Privilege escalation in LeafWiki versions 0.1.0 through 0.10.0 allows any authenticated user to elevate their own account role to administrator by manipulating the user update API. The flaw stems from improper privilege management (CWE-269) in the API endpoint responsible for account updates, which fails to enforce role-assignment restrictions. No public exploit code has been identified at time of analysis, but the attack is straightforward for any user with a valid account, making instances with open or semi-trusted registration particularly exposed.
Uncontrolled ZIP extraction in LeafWiki 0.10.0 through 0.12.0 allows any authenticated Editor or Admin to exhaust server disk or memory by uploading a crafted ZIP bomb via the import route. The vulnerable function ZipExtractor.ExtractToDir uses Go's io.Copy without a decompressed-size limit, so a maximally compressed archive well inside the 500 MiB upload cap can expand to hundreds of gigabytes on disk - or into RAM when the OS temporary directory is tmpfs-backed. No public exploit has been identified at time of analysis, though the attack is mechanically simple for any credentialed Editor.
Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScript payload in a page title, which executes in any victim's browser when they view search results containing that title. No public exploit identified at time of analysis. The attack surface widens significantly when the `--public-access` flag is enabled, making unauthenticated visitors viable targets; in default authenticated-only deployments, the blast radius is limited to logged-in users. A vendor-released patch is available in version 0.10.2.
Path traversal in LeafWiki's asset rename endpoint allows authenticated editors to relocate any file readable by the server process into a page's public asset directory, making it downloadable over HTTP. All releases from 0.3.0 through 0.10.0 (CPE: cpe:2.3:a:perber:leafwiki:*:*:*:*:*:*:*:*) are affected; version 0.10.1 contains the fix. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low exploitation complexity and high-impact outcome - including potential exposure of the application database - make prompt patching urgent for any multi-user deployment.
Privilege escalation in LeafWiki versions 0.1.0 through 0.10.0 allows any authenticated user to elevate their own account role to administrator by manipulating the user update API. The flaw stems from improper privilege management (CWE-269) in the API endpoint responsible for account updates, which fails to enforce role-assignment restrictions. No public exploit code has been identified at time of analysis, but the attack is straightforward for any user with a valid account, making instances with open or semi-trusted registration particularly exposed.