Threat Intelligence Database

LeafWiki versions 0.3.0 through 0.10.0 contain a relative path traversal vulnerability in the asset rename functionality. An authenticated user with editor permissions can move files accessible to the LeafWiki server into a page's asset directory, potentially exposing sensitive local files such as the application database. Users should update to version 0.10.1 or later. Operators are advised to run the LeafWiki process with least privilege and restrict editor access until patched.

LeafWiki versions 0.1.0 through 0.10.0 contain a privilege escalation vulnerability in the user update API that allows authenticated users to escalate their privileges from regular user roles to admin. Exploitation requires a valid authenticated account. Instances without public registration and with only trusted users are at lower risk. Users should update to version 0.10.1 or later. Until patched, restricting account creation and limiting access to the user update API to trusted users or administrators is recommended.