A high-severity path traversal vulnerability in LeafWiki allows authenticated attackers to access sensitive system files, posing a significant risk to data confidentiality and integrity.

This vulnerability is a relative path traversal (CWE-23) flaw. An authenticated user with low privileges can manipulate file paths to escape the intended directory, potentially reading or modifying arbitrary files on the host server.

The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive configuration files, source code, or internal data. Given the CVSS score of 8.8, the potential for total system compromise is significant, which could result in severe reputational damage and operational disruption.

Immediate Action: Update LeafWiki to version 0.10.1 or later as specified by the vendor security advisory.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing malicious path navigation characters targeting the application.

Public Exploit Available: No

This vulnerability represents a high risk to organizational security. Administrators are urged to prioritize the update to the patched version immediately to ensure the integrity of the application environment.