Path Traversal Vulnerability in LeafWiki Affects Multiple Versions from Leading Vendor
CVE-2026-53528

8.8HIGH

Key Information:

Vendor

Perber

Status
Leafwiki
Vendor
CVE Published:
21 August 2026

What is CVE-2026-53528?

LeafWiki, a self-hosted wiki platform, is susceptible to a path traversal vulnerability within its asset rename functionality in versions 0.3.0 through 0.10.0. An authenticated user possessing editor permissions could exploit this flaw to manipulate file paths, potentially allowing access to sensitive local files, including the application database. Users are advised to upgrade to version 0.10.1 or later to mitigate this risk. To further protect the environment, it is recommended that operators limit the privileges of the LeafWiki process and avoid granting filesystem access to sensitive directories. Until a patch is implemented, editor access should be restricted to trusted users.

Affected Version(s)

leafwiki >= 0.3.0, < 0.10.1

References

https://github.com/perber/leafwiki/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.