Unbounded ZIP Extraction in LeafWiki by Perber

CVE-2026-80189

What is CVE-2026-80189?

LeafWiki contains a vulnerability that allows users with Editor or Admin roles to upload ZIP archives without proper constraints on the extracted data size. The ZIP extraction process does not limit how much data can be written out, leading to potential excessive resource consumption. While the upload limit is set to 500 MiB, a ZIP file can contain entries that, when decompressed, far exceed this limit, potentially leading to hundreds of gigabytes of data. This unbounded extraction can exhaust the storage capacity of the underlying file system, particularly if the extraction occurs in a temporary directory backed by memory (tmpfs), impacting the overall service availability.

References