LeafWiki’s RenameAsset endpoint fails to validate the oldFilename parameter, allowing an authenticated editor to supply a path that points outside the intended asset directory. This enables the application to move any file the Wiki process can read into a page’s asset folder, after which the file can be downloaded as a normal page asset. The result is disclosure of sensitive local files such as the database. The flaw is an example of CWE-23: Path Traversal.

LeafWiki versions 0.3.0 through 0.10.0 released by the vendor perber:leafwiki are vulnerable. Affected users are advised to upgrade to version 0.10.1 or higher. No other versions are impacted.

The CVSS score of 8.8 signals a high‑severity vulnerability, although no EPSS value is available, so the likelihood of exploitation remains undetermined. The flaw requires an authenticated editor, indicating it is most likely exploitable by insiders or attackers who have compromised user credentials. While the vulnerability has not been indexed in the CISA KEV catalog, the potential to expose critical files poses a serious risk. Until the patch is applied, restricting editor permissions to trusted users and limiting the file system privileges of the LeafWiki process can reduce exposure.