Description
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded archive is bounded and the size it expands to is not. The import route that reaches this code requires the Editor or Admin role, and the upload itself is capped at 500 MiB compressed. Because a ZIP entry can compress at a very high ratio, an archive well inside that cap can expand to hundreds of gigabytes as it is written out. The extraction directory defaults to a location under the operating system temporary directory, so the written data consumes the disk backing that path, which on a tmpfs-backed temporary directory is memory. A user holding the Editor role can therefore exhaust the storage the service depends on and keep it from serving, using far more resource than the upload limit alone would permit.
Published: 2026-08-25
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

LeafWiki allows an authenticated user with Editor or Admin privileges to upload a ZIP archive for import. The extraction code copies each archive entry to a temporary directory without limiting the decompressed size, meaning a 500‑MiB compressed file can expand to many gigabytes. This can exhaust the disk space or memory backing the temporary area, rendering the service unavailable. The flaw is a classic instance of uncontrolled resource consumption (CWE‑409).

Affected Systems

The issue exists in LeafWiki versions 0.10.0 through 0.12.0. The vendor is perber and the product is LeafWiki. Versions below 0.12.1 are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑severity vulnerability, but the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Exploitation requires authenticated access and the Editor or Admin role, so the attack vector is privilege‑extension at the application layer. An attacker with sufficient privileges can trigger the extraction and saturate storage, leading to a denial‑of‑service condition for all users.

Generated by OpenCVE AI on August 26, 2026 at 01:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade LeafWiki to the patched release v0.12.1 or later.
  • If an immediate upgrade is not possible, configure a disk quota or move the temporary extraction directory to a dedicated volume with limited size.
  • Restrict the import route to the Admin role only, reducing the pool of users who can trigger large decompressions.

Generated by OpenCVE AI on August 26, 2026 at 01:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Perber
Perber leafwiki
Vendors & Products Perber
Perber leafwiki

Tue, 25 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Description LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded archive is bounded and the size it expands to is not. The import route that reaches this code requires the Editor or Admin role, and the upload itself is capped at 500 MiB compressed. Because a ZIP entry can compress at a very high ratio, an archive well inside that cap can expand to hundreds of gigabytes as it is written out. The extraction directory defaults to a location under the operating system temporary directory, so the written data consumes the disk backing that path, which on a tmpfs-backed temporary directory is memory. A user holding the Editor role can therefore exhaust the storage the service depends on and keep it from serving, using far more resource than the upload limit alone would permit.
Title LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction
Weaknesses CWE-409
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Perber Leafwiki
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-25T23:18:58.993Z

Reserved: 2026-08-25T22:34:53.692Z

Link: CVE-2026-80189

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T01:15:04Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)