CVE-2026-90946

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

CVE-2026-90946 DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

EUVD-2026-77713

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

CVE-2026-90946

DeepWiki-Open (through commit d92819a ) contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint. The repo_url parameter is accepted as a raw filesystem path with no containment , allowing attackers to supply arbitrary directory paths and read files with su...

CVE-2026-72602

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

CVE-2026-72602

CVE-2026-72602 affects AsyncFuncAI deepwiki-open. A path traversal flaw in the local-repository structure endpoint (through commit 16f35a0) allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths, since WIKI_AUTH_MODE defaults to false. This enables enu...

CVE-2026-72602 AsyncFuncAI deepwiki-open - Path Traversal

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

EUVD-2026-56041

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

CVE-2026-72602

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

PT-2026-70146

Name of the Vulnerable Software and Affected Versions AsyncFuncAI deepwiki-open versions prior to commit 16f35a0 Description A path traversal issue allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths. This occurs via the 'local-repository structure'...

CVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

CVE-2026-72567

The CVE-2026-72567 entry concerns AsyncFuncAI/deepwiki-open. A path traversal flaw arises from improper validation in the wiki-cache API endpoint (api/api.py) which builds file paths from user-controlled owner, repo, and repo_type fields, allowing unauthenticated remote actors to write to or dele...

EUVD-2026-55239

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

CVE-2026-72567 deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...