Otter Wiki CVE-2026-120501

The attacker must be able to edit a wiki page; under Otter Wiki's default configuration this includes anonymous (unauthenticated) users, which is why no account is required by default. The specific prerequisite is the DataTable embedding feature accepting an absolute src value (e.g. {{datatable |src=/.git/config}}), which the server resolves and renders as a table, including files inside the repository's .git directory. The vendor fix also addresses two related conditions shown in the tests: case-insensitive filesystems where .GIT equals .git, and symlinks (e.g. pushed via git) pointing into .git. Exploitation is LIMITED on instances that disable anonymous editing or restrict page-edit rights, where an attacker would need a valid account with edit permissions; impact is bounded to reading repository-internal files (notably git remote credentials) and does not include write or denial-of-service effects.

This is a genuine but moderate-priority information-disclosure flaw (CWE-552) in Otter Wiki, not a high-CVSS/low-real-risk artifact. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no privileges or user interaction, and the description confirms the mechanism: under the default configuration anonymous users can edit pages, so PR:N is justified by the product's default state rather than contradicted by the text. Impact is deliberately scoped as VC:L / C-only (VI:N, VA:N) because the flaw reads repository-internal files but does not write or crash - however the concrete payload (/.git/config) can expose stored git remote credentials, which can be a stepping stone to further compromise, so the Low confidentiality rating arguably understates downstream consequence. No EPSS score, KEV listing, or POC/exploit-code reference is present in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patched, credentialed-impact bug that is not confirmed as actively exploited. Net: patch within the vendor/decision-label window; the main risk driver is the trivial trigger against instances that allow anonymous or low-privilege page editing.

On an Otter Wiki instance running a vulnerable version (2.20.1 up to before 2.26.2) with the default configuration that permits anonymous page editing, an unauthenticated attacker creates or edits a page containing a DataTable embedding whose src is set to an absolute path such as /.git/config. When the page is rendered, the server reads that repository-internal file and displays its contents as a table, disclosing stored git remote credentials. No public exploit code is referenced in the available data, but the trigger is simple and fully described in the vendor's commit and tests.