CVE-2026-53528 is a path traversal vulnerability (CWE-23) affecting LeafWiki, a self-hosted wiki software. Versions from 0.3.0 up to but not including 0.10.1 allow an authenticated editor to rename and move files accessible to the server into the wiki's asset directory. This can lead to unauthorized disclosure of sensitive local files, including the application database, by making them downloadable as page assets. The vulnerability requires editor-level privileges and no user interaction beyond authentication. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated editor to access sensitive local files by moving them into the wiki's asset directory, potentially exposing critical data such as the application database. This compromises confidentiality, integrity, and availability of the affected system.

Users should update LeafWiki to version 0.10.1 or later, where this vulnerability is fixed. Until patching, operators should restrict editor permissions to trusted users only and ensure the LeafWiki process runs with the least privileges necessary, limiting filesystem access to only required directories. These mitigations reduce the risk of unauthorized file exposure.