CVE-2026-72567
Received Received - Intake

Path Traversal in DeepWiki Open

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72567
EUVD
EUVD-2026-55239

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
asyncfuncai deepwiki-open *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper path validation flaw in the DeepWiki-Open project. It allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges by exploiting path traversal through user-controlled fields in the api/api.py wiki-cache endpoint. The issue arises because the file paths are constructed without sanitization from owner, repo, and repo_type inputs.

Impact Analysis

If you are running a vulnerable version of DeepWiki-Open, attackers could exploit this to overwrite or delete critical system files, leading to system compromise, data loss, or denial of service. Since the attack is unauthenticated, any exposed instance is at risk regardless of user privileges.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements under GDPR and HIPAA. Organizations using DeepWiki-Open may face compliance breaches if sensitive data is exposed or altered due to the flaw.

Mitigation Strategies

Immediately disable or restrict access to the DeepWiki-Open service until patches are applied. Review and sanitize all user-controlled input fields in the api/api.py wiki-cache endpoint to prevent path traversal. Ensure the service does not run with root privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72567. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart