CVE-2026-120501
Received Received - Intake

Otter Wiki File Disclosure via DataTable Embedding

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120501

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redimp otterwiki 2.20.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Otter Wiki versions 2.20.1 to 2.26.1 allows attackers who can edit pages, including anonymous users by default, to read internal files on the server. By setting a malicious absolute src path like /.git/config in the DataTable embedding feature, attackers can force the wiki to display the contents of sensitive files as a table, potentially exposing credentials stored in the repository.

Detection Guidance

Check for unauthorized access to sensitive files like /.git/config or other repository-internal files through Otter Wiki's DataTable embedding feature. Review wiki page edits for suspicious absolute src attributes pointing to internal paths.

Impact Analysis

If you use Otter Wiki 2.20.1 to 2.26.1, attackers could access sensitive files like configuration files, credentials, or internal data. This could lead to data breaches, unauthorized access to systems, or exposure of confidential information stored in the wiki's repository.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR, HIPAA, or other regulations by exposing personal or sensitive data. Unauthorized access to internal files may result in data leaks, leading to legal penalties, reputational damage, or loss of certification for failing to protect sensitive information.

Mitigation Strategies

Upgrade Otter Wiki to version 2.26.2 or later. Restrict page editing permissions to trusted users only. Disable anonymous editing if enabled by default. Monitor for unusual file access patterns in wiki logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...