Description

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T22:16:39.290Z",
  "pubdate": "2026-08-21T22:16:39.290Z",
  "executiveSummary": "LeafWiki versions 0.3.0 through 0.10.0 contain a critical path traversal vulnerability within the application's asset rename functionality.\nThis security flaw enables an authenticated user possessing editor permissions to manipulate file paths and relocate arbitrary files accessible to the LeafWiki server process directly into a designated page asset directory.\nSuccessful exploitation of this vulnerability results in sensitive local files, including critical internal resources such as the application database, becoming publicly downloadable as standard page assets.\nThe risk implications are severe, as unauthorized retrieval of application databases often leads to complete confidentiality compromise, credential exposure, and potential system-wide compromise.\nThe attack vector requires authenticated access with specific editor-level privileges within the application.\nOperators must ensure that the LeafWiki process operates under the principle of least privilege, restricting filesystem access exclusively to required application directories, and immediately update to version 0.10.1 or greater to remediate the flaw.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization within the asset rename functionality of LeafWiki.\nWhen processing asset rename operations, the application fails to adequately restrict user-supplied path inputs, allowing directory traversal sequences (such as relative path notation) to be processed by the underlying file system handler.\nThe vulnerable component is specifically the asset rename subsystem responsible for managing and relocating files associated with wiki pages.\nAffected software versions span from 0.3.0 up to and including 0.10.0.\nExploitation of this vulnerability requires authentication with editor permissions, meaning unauthenticated attackers cannot directly trigger the flaw without prior credential compromise.\nThe attack flow proceeds as follows: First, the authenticated attacker with editor privileges initiates an asset rename or move request via the LeafWiki interface or API. Second, the attacker supplies a crafted path containing traversal sequences targeting a sensitive local file accessible to the privileges of the running LeafWiki server process, such as the core application database. Third, the application processes the request without proper path normalization or boundary enforcement, successfully moving the target sensitive file into the page's designated asset directory. Finally, the attacker accesses the corresponding page asset URL to download the relocated sensitive file, thereby exposing confidential system data.\nThe post-exploitation impact includes the unauthorized extraction of sensitive system configurations, application databases, and other local assets readable by the web application process context."
}