Executive brief
LeafWiki is a self-hosted wiki application that allows authenticated users to import content by uploading ZIP archives. The application extracts ZIP files without limiting how much disk space (or memory, on systems with tmpfs-based temp directories) the extracted data can consume. An attacker with Editor or Admin role can craft a highly-compressed ZIP archive that, while staying within the 500 MiB upload limit, expands to hundreds of gigabytes during extraction, exhausting storage and making the service unavailable.
Technical details
The vulnerability is a zip bomb (decompression bomb) in the ZipExtractor.ExtractToDir function located in internal/importer/zip_extractor.go. The root cause is the use of io.Copy to extract ZIP entries without enforcing any limits on decompressed data size; only the compressed archive size is bounded at 500 MiB. An attacker can create a ZIP file with entries that compress at very high ratios (e.g., millions of zeros compressed into kilobytes), which when decompressed will consume far more storage than the upload cap permits. The extraction defaults to the OS temporary directory (often tmpfs-backed, consuming RAM), and requires only Editor or Admin role authentication. A successful exploit causes denial of service by exhausting available disk/memory resources. No patch information is available in the advisory.
Affected products
- LeafWiki LeafWiki 0.12.0 and earlier
Timeline
- 2026-08-26: disclosed