CVE-2026-53528

Name of the Vulnerable Software and Affected Versions LeafWiki versions 0.3.0 through 0.10.0

Description LeafWiki contains a path traversal flaw within the asset rename functionality. This issue occurs because the application fails to properly sanitize user-supplied file paths during the rename operation. An authenticated user with editor permissions can exploit this to move sensitive local files, such as the application database or system configuration files, into a page's asset directory, making them publicly downloadable. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences.

Recommendations Update to version 0.10.1 or greater. Restrict editor access to trusted users only. Ensure the LeafWiki process runs with the least privileges necessary and lacks filesystem access to sensitive files outside the required application directories.