Read the docs
TI-2026-38602 Aliases CVE-2026-53529

LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With `--public-access` enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed leafwiki (perber): 0.10.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
perberleafwikibefore 0.10.20.10.2Patch availableCNA
  • leafwiki Vendorperber Affected before 0.10.2 Fixed in 0.10.2 Patch available CNA

Remediation

  • Fix · CNA leafwiki (perber) Fixed in 0.10.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53529

References

Other 1

  • TI-2026-38601 FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter CVSS 3.1HIGH 8.8
  • TI-2026-38600 LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update CVSS 3.1HIGH 8.8
  • TI-2026-55430 LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences