CVE-2026-53528 Overview
CVE-2026-53528 is a path traversal vulnerability [CWE-23] in LeafWiki, a self-hosted wiki application. The flaw resides in the asset rename functionality of versions 0.3.0 through 0.10.0. An authenticated user with editor permissions can move files accessible to the LeafWiki server process into a page's asset directory. This exposes sensitive local files, including the application database, as downloadable page assets. The maintainers addressed the issue in version 0.10.1.
Critical Impact
Authenticated editors can relocate arbitrary files readable by the LeafWiki process into public asset directories, leading to disclosure of sensitive data such as the application database.
Affected Products
- LeafWiki version 0.3.0 through 0.10.0
- Self-hosted LeafWiki deployments running affected releases
- Fixed in LeafWiki 0.10.1 and later
Discovery Timeline
- 2026-08-21 - CVE-2026-53528 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-53528
Vulnerability Analysis
The vulnerability affects LeafWiki's asset rename endpoint, which permits editors to reorganize files attached to wiki pages. The rename operation does not sufficiently constrain the source path supplied by the user. An authenticated editor can supply traversal sequences that resolve outside the intended asset directory. LeafWiki then moves the referenced file into a page's public asset folder. Once relocated, the file becomes downloadable through the standard asset delivery path. The vulnerability requires authenticated editor privileges but no user interaction.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-23]. LeafWiki accepts a user-controlled path for the rename source and fails to validate that the resolved location remains within the permitted asset directory hierarchy. Any file readable by the LeafWiki process becomes a candidate for relocation, including the application database and configuration files that the process needs to run.
Attack Vector
Exploitation requires network access to the LeafWiki instance and valid editor credentials. The attacker issues a rename request that references a sensitive filesystem path as the source and a page asset location as the destination. The server executes the move using its own filesystem privileges. The attacker then retrieves the file through the normal asset download URL associated with the target page. See the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-53528
Indicators of Compromise
- Rename API requests containing traversal sequences such as ../ or absolute filesystem paths in the source parameter.
- Unexpected files appearing in page asset directories, particularly files with database, configuration, or credential extensions.
- Outbound downloads of unusually large or non-media assets from LeafWiki pages.
Detection Strategies
- Review LeafWiki application and reverse-proxy logs for rename endpoint activity referencing paths outside the configured asset root.
- Alert on filesystem changes where the LeafWiki process writes to or removes files outside its asset directory.
- Correlate editor account activity with asset directory modifications to identify anomalous rename patterns.
Monitoring Recommendations
- Enable verbose access logging on the LeafWiki service and forward events to a centralized log platform.
- Monitor authentication events for editor role assignments and unexpected privilege changes.
- Track file integrity on the host, focusing on the LeafWiki data directory and the application database file.
How to Mitigate CVE-2026-53528
Immediate Actions Required
- Upgrade LeafWiki to version 0.10.1 or later on all self-hosted instances.
- Audit existing page asset directories for files that should not be publicly downloadable and remove them.
- Rotate credentials and secrets that may have been exposed through the application database or configuration files.
Patch Information
The LeafWiki maintainers released version 0.10.1 to remediate the path traversal issue. Operators should upgrade from any release in the 0.3.0 through 0.10.0 range. Release notes and remediation details are available in the GitHub Security Advisory GHSA-g2wp-jm5c-jqfj.
Workarounds
- Run the LeafWiki process under a dedicated low-privilege account with filesystem access restricted to the application's required directories.
- Restrict editor role assignments to trusted users until the patch is deployed.
- Apply operating system-level access controls so sensitive files, including the LeafWiki database, are not readable by the service account beyond required paths.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
