Quick answers
- Is CVE-2026-80189 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-80189 being exploited in the wild.
- How severe is CVE-2026-80189?
- Medium severity, with a CVSS score of 6.5, published 26 August 2026.
- Which products and versions are affected?
- LeafWiki 0.12.0 and earlier.
- Is there a fix for CVE-2026-80189?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-80189 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-80189?
- Check whether you run LeafWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a zip bomb (decompression bomb) in the ZipExtractor.ExtractToDir function located in internal/importer/zip_extractor.go. The root cause is the use of io.Copy to extract ZIP entries without enforcing any limits on decompressed data size; only the compressed archive size is bounded at 500 MiB. An attacker can create a ZIP file with entries that compress at very high ratios (e.g., millions of zeros compressed into kilobytes), which when decompressed will consume far more storage than the upload cap permits. The extraction defaults to the OS temporary directory (often tmpfs-backed, consuming RAM), and requires only Editor or Admin role authentication. A successful exploit causes denial of service by exhausting available disk/memory resources. No patch information is available in the advisory.
Affected products
- LeafWiki LeafWiki 0.12.0 and earlier
Timeline
- 2026-08-26: disclosed