Path Traversal in DeepWiki Open

Executive Summary

This is a path traversal vulnerability in AsyncFuncAI deepwiki-open where unauthenticated remote attackers can access directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and returns directory contents without requiring authentication because WIKI_AUTH_MODE defaults to false.

Useful 0 Not Useful 0

Detection Guidance

Check if the DeepWiki-Open service is running and accessible. Test for path traversal by sending requests to the local-repository structure endpoint with absolute filesystem paths. Example: curl http://target-server/local-repository?path=/etc/

Useful 0 Not Useful 0

Impact Analysis

An attacker could enumerate sensitive directory contents on the host system, potentially exposing confidential files, source code, configuration files, or other sensitive data stored on the server running the vulnerable application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and potentially exposing personal data without consent. For HIPAA, it may result in unauthorized access to protected health information, breaching confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the local-repository structure endpoint if not needed. Set WIKI_AUTH_MODE to true to enforce authentication. Restrict network access to the service via firewall rules. Update to a patched version if available.

Useful 0 Not Useful 0