CVE-2026-80189

Name of the Vulnerable Software and Affected Versions LeafWiki (affected versions not specified)

Description An issue exists where the software extracts uploaded ZIP archives without limiting the amount of data written to the disk. The ZipExtractor.ExtractToDir function in internal/importer/zip extractor.go uses io.Copy to process entries, which continues until the decompressed stream ends. While the compressed upload is capped at 500 MiB, high compression ratios allow an archive to expand to hundreds of gigabytes. Since the extraction occurs in the operating system temporary directory, this can exhaust disk space or memory (if using a tmpfs-backed directory), allowing a user with the Editor or Admin role to cause a denial of service by consuming critical system resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.