CVE-2026-80189: LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zipextractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed stream, so only the size of the uploaded archive is bounded and the size it expands to is not. The import route that reaches this code requires the Editor or Admin role, and the upload itself is capped at 500 MiB compressed. Because a ZIP entry can compress at a very high ratio, an archive well inside that cap can expand to hundreds of gigabytes as it is written out. The extraction directory defaults to a location under the operating system temporary directory, so the written data consumes the disk backing that path, which on a tmpfs-backed temporary directory is memory. A user holding the Editor role can therefore exhaust the storage the service depends on and keep it from serving, using far more resource than the upload limit alone would permit.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Editor or Admin role can reach the vulnerable import route. Unauthenticated users and users without one of those roles are not described as having access to the extraction path.
Does the 500 MiB upload limit prevent disk exhaustion?
No. The limit applies to the compressed ZIP upload, while extraction writes data until the end of each decompressed entry. A ZIP archive below 500 MiB can expand to hundreds of gigabytes.
Which resource is at risk during extraction?
The extraction output is written beneath the operating system temporary directory by default, consuming the storage that backs that path. If the temporary directory is tmpfs-backed, the extraction consumes memory rather than ordinary disk space.
What is the likely operational impact?
A permitted user can exhaust the storage used by the service and prevent it from serving requests. The stated impact is availability loss; no confidentiality or integrity impact is described.