---
id: CVE-2026-53529
title: LeafWiki is a self-hosted wiki
summary: >-
  LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned
  by the search API could be rendered as raw HTML in the frontend. A user with
  editor or administrator permissions could create or modify a page title
  containing…
severity: none
cwe:
  - CWE-79
published: '2026-08-21'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:06:39.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53529'
references:
  - url: 'https://github.com/perber/leafwiki/security/advisories/GHSA-j344-qxqm-wg64'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00243
epssPercentile: 0.15818
ingestedAt: '2026-09-09T21:22:45.548Z'
---

## Overview

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With `--public-access` enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.