CVE-2026-53528

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process.

• CWE-23

• https://github.com/perber/leafwiki/security/advisories/GHSA-g2wp-jm5c-jqfj

Published

Aug 21, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53521Nezha Monitoring is a self-hostable, lightweight, servers an…6.4
• CVE-2026-53522Nezha Monitoring is a self-hostable, lightweight, servers an…6.5
• CVE-2026-53523Nezha Monitoring is a self-hostable, lightweight, servers an…6.8
• CVE-2026-53524WeeChat (Wee Enhanced Environment for Chat) is a free chat c…6.5
• CVE-2026-53525WeeChat (Wee Enhanced Environment for Chat) is a free chat c…7.4
• CVE-2026-53527LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.…8.8
• CVE-2026-53529LeafWiki is a self-hosted wiki. Prior to version 0.10.2, pag…4.8
• CVE-2026-5353A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. …8.8
• CVE-2026-53530RaTeX is a KaTeX-compatible math rendering engine written in…8.7
• CVE-2026-53531RaTeX is a KaTeX-compatible math rendering engine written in…6.9
• CVE-2026-53532OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-53533aiosmtplib is an asynchronous SMTP client for use with async…6.9