CVE-2026-53528

Received Received - Intake

Path Traversal in LeafWiki Asset Rename

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53528

Affected Vendors & Products

Vendor	Product	Version / Range
leafwiki	leafwiki	From 0.3.0 (inc) to 0.10.0 (inc)
leafwiki	leafwiki	0.10.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

LeafWiki versions 0.3.0 through 0.10.0 contain a path traversal vulnerability in the asset rename feature. An authenticated editor can move files accessible to the server into a page's asset directory, potentially making sensitive files like the application database downloadable as assets.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized file access or movement within LeafWiki's asset directories. Review server logs for suspicious file operations, particularly actions by authenticated editors that modify file paths. Look for files outside expected directories or unusual file types in asset folders. Ensure the LeafWiki process has minimal filesystem permissions and does not access sensitive directories.

Impact Analysis

This vulnerability allows an attacker with editor access to expose sensitive server files, such as the application database, by moving them into a publicly accessible asset directory. This could lead to data leaks or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information privacy). Exposure of personal or health data may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update LeafWiki to version 0.10.1 or later. Restrict editor access to trusted users only. Ensure the LeafWiki process runs with least privileges and lacks filesystem access to sensitive files outside required directories. Temporarily limit editor permissions until the update is applied.

Hi! I’m here to help you understand CVE-2026-53528. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70