CVE-2026-53529

Received Received - Intake

Reflected XSS in LeafWiki Search API

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With `--public-access` enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-53529

Affected Vendors & Products

Vendor	Product	Version / Range
leafwiki	leafwiki	to 0.10.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

LeafWiki before version 0.10.2 has a vulnerability where page titles in search results could be rendered as raw HTML. This allows users with editor or admin permissions to inject HTML or JavaScript payloads into page titles. When other users search for matching terms, the payload executes in their browsers.

Detection Guidance

To detect this vulnerability, check if your LeafWiki instance is running a version prior to 0.10.2. Verify the version by inspecting the application files or running commands like 'grep -r "version" /path/to/leafwiki' or checking the web interface if accessible. Also monitor browser console logs for XSS errors when searching.

Impact Analysis

The impact depends on deployment settings. If public access is enabled, unauthenticated visitors could be affected. In authenticated-only setups, logged-in users searching for specific terms could have their browsers compromised via cross-user XSS. Attackers could steal session cookies or perform actions on behalf of victims.

Compliance Impact

This vulnerability could lead to cross-site scripting (XSS) attacks, potentially exposing sensitive user data. For GDPR, this may result in unauthorized data access or processing, violating principles of data protection and user consent. For HIPAA, it could compromise protected health information if exploited in healthcare-related deployments.

Mitigation Strategies

Immediately upgrade LeafWiki to version 0.10.2 or later. If upgrading is not possible, disable the search API or restrict access to it. Review page titles for suspicious HTML/JavaScript payloads. For public deployments, consider disabling --public-access until patched.

Hi! I’m here to help you understand CVE-2026-53529. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70