CVE-2026-53529: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in perber leafwiki

CVE-2026-53529 is a CWE-79 cross-site scripting vulnerability in LeafWiki, a self-hosted wiki software. Before version 0.10.2, the search API returned page titles that could be rendered as raw HTML in the frontend. This allowed users with editor or administrator privileges to insert HTML/JavaScript payloads into page titles. When other users searched for terms matching these titles, the payloads executed in their browsers. The vulnerability's impact depends on whether the deployment allows public access or restricts search results to authenticated users. The vulnerability was addressed in LeafWiki version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML, while still preserving search result highlighting.

Successful exploitation allows an attacker with editor or administrator permissions to execute arbitrary JavaScript in the browsers of users who perform searches that return the malicious page titles. This could lead to session hijacking, unauthorized actions, or other typical XSS impacts depending on the deployment context. If the wiki is configured with public access enabled, unauthenticated visitors can be affected. In authenticated-only deployments, the attack targets logged-in users who can access search results. The CVSS 4.0 base score is 4.8 (medium severity), reflecting network attack vector, low attack complexity, and required privileges.

A fix is available in LeafWiki version 0.10.2, which sanitizes page titles in search results to prevent them from being interpreted as raw HTML. Users should upgrade to version 0.10.2 or later to remediate this vulnerability. No other specific mitigations are indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in 0.10.2.