CVE-2026-80189: Improper Handling of Highly Compressed Data (Data Amplification) in perber leafwiki

The vulnerability in LeafWiki arises from the ZipExtractor.ExtractToDir function, which extracts uploaded ZIP archives without limiting the amount of data written after decompression. Although the compressed upload size is capped at 500 MiB, the decompressed data size is unbounded, allowing an attacker with Editor or Admin privileges to upload a highly compressed archive that expands to consume excessive disk or memory resources. The extraction occurs in a temporary directory, which may be memory-backed (tmpfs), leading to potential memory exhaustion and service disruption. This is a data amplification issue caused by improper handling of compressed data during extraction.

An attacker with Editor role privileges can cause denial of service by exhausting disk or memory resources through uploading a highly compressed ZIP archive that expands to a very large size during extraction. This can prevent the service from functioning properly due to resource exhaustion. There is no indication of privilege escalation or code execution from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor uploads of ZIP archives by users with Editor or Admin roles, and consider implementing limits on decompressed archive size or extraction resource usage to prevent resource exhaustion.