CVE-2026-80189 Overview
LeafWiki versions 0.10.0 through 0.12.0 contain an uncontrolled resource consumption vulnerability in the ZIP archive import feature. The ZipExtractor.ExtractToDir function in internal/importer/zip_extractor.go uses io.Copy to write each archive entry to disk without limiting the decompressed output size. Attackers holding the Editor or Admin role can upload a compressed archive under the 500 MiB cap that expands to hundreds of gigabytes. The extraction target defaults to the operating system temporary directory, which may be backed by tmpfs and consume memory instead of disk. The vulnerability is tracked under [CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)].
Critical Impact
An authenticated user with Editor privileges can exhaust storage or memory on the host, rendering the LeafWiki service unavailable.
Affected Products
- LeafWiki 0.10.0 through 0.12.0
- Fixed in LeafWiki 0.12.1
- Deployments using tmpfs-backed temporary directories face additional memory exhaustion risk
Discovery Timeline
- 2026-08-26 - CVE-2026-80189 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-80189
Vulnerability Analysis
The flaw is a classic ZIP bomb condition. LeafWiki's import route accepts a ZIP archive up to 500 MiB compressed, then passes it to ZipExtractor.ExtractToDir. That function opens each entry and streams the decompressed bytes to disk using Go's io.Copy. The copy loop terminates only when the decompressed stream ends, which for a maliciously crafted archive can be orders of magnitude larger than the source. A single entry containing highly redundant data can achieve compression ratios well above 1000:1. An archive of a few hundred megabytes can therefore expand to hundreds of gigabytes on the filesystem hosting the extraction target.
Root Cause
The root cause is missing enforcement of a maximum decompressed size during archive extraction. The upload size limit protects the ingest path but does not constrain the output side. No per-entry size ceiling, aggregate output ceiling, or compression ratio check exists in the vulnerable code path. The extraction directory also defaults to a location under the operating system temporary directory, amplifying impact on systems where that path is tmpfs.
Attack Vector
Exploitation requires an authenticated account with the Editor or Admin role. The attacker crafts a ZIP archive containing one or more entries with high compression ratios, submits it through the standard import endpoint, and waits for the server to expand the payload. Because io.Copy proceeds to completion, the process writes until the underlying storage or memory backing tmpfs is exhausted. The service then fails to allocate space for legitimate operations, producing a denial of service condition. See the GitHub Security Advisory GHSA-258m-crqp-25xc and the VulnCheck LeafWiki Advisory for additional detail.
Detection Methods for CVE-2026-80189
Indicators of Compromise
- Sudden growth of files under the operating system temporary directory during or after a LeafWiki import request
- Rapid consumption of disk space or memory on the LeafWiki host with no correlated legitimate workload
- HTTP requests to the LeafWiki import endpoint from Editor or Admin accounts that precede resource exhaustion events
- LeafWiki process failures or restarts referencing no space left on device or out-of-memory conditions
Detection Strategies
- Monitor filesystem usage on the volume backing the temporary directory used by LeafWiki and alert on rapid growth
- Correlate LeafWiki application logs of import operations with host-level disk and memory metrics
- Audit LeafWiki accounts holding the Editor or Admin role and track their upload activity
Monitoring Recommendations
- Emit metrics for temporary directory size and inode usage at short intervals on hosts running LeafWiki
- Log all archive imports with the authenticated user, upload size, and duration for later review
- Alert when a single import operation exceeds an expected wall-clock or output size threshold
How to Mitigate CVE-2026-80189
Immediate Actions Required
- Upgrade LeafWiki to version 0.12.1 or later, which addresses the unbounded extraction path
- Restrict the Editor and Admin roles to trusted operators until the upgrade is complete
- Move the extraction directory off any tmpfs-backed path to prevent memory exhaustion
- Apply filesystem quotas to the account or path used by the LeafWiki service
Patch Information
The fix is available in LeafWiki Release v0.12.1. The vulnerable code lives in zip_extractor.go at v0.12.0. Review the GitHub Security Advisory GHSA-258m-crqp-25xc for full vendor guidance and upgrade instructions.
Workarounds
- Disable the archive import feature or block the import route at a reverse proxy until patched
- Enforce a per-user or per-service disk quota that bounds how much data extraction can consume
- Redirect the temporary directory to a dedicated volume with a hard size limit
- Reduce the maximum accepted upload size well below 500 MiB to shrink the amplification ceiling
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
