Deepwiki Open
Monthly
Unauthenticated arbitrary file read in DeepWiki-Open (AsyncFuncAI) through commit d92819a lets anyone who can reach the /ws/chat WebSocket endpoint pass an arbitrary directory path as the repo_url parameter and have the server walk that path with no containment check, exfiltrating every readable Python, JavaScript, YAML and JSON file it finds. Because the read is aimed at source and configuration files, the practical payoff is hardcoded secrets, API keys and credentials rather than code execution. A public proof of concept is indicated by SSVC exploitation status and the flaw is fully automatable, though it is not listed in CISA KEV as actively exploited.
Unauthenticated remote directory listing in deepwiki-open through commit 16f35a0 allows any network-accessible attacker to enumerate arbitrary filesystem paths on the host by supplying absolute path parameters to the local-repository structure endpoint. The root cause is a combination of missing input path restriction (CWE-22) and an authentication layer that is disabled by default (WIKI_AUTH_MODE=false), meaning every default deployment is immediately vulnerable without any configuration change. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any internet-exposed instance.
Arbitrary file write and delete as root in AsyncFuncAI DeepWiki-Open (through commit 16f35a0) lets unauthenticated remote attackers corrupt, overwrite, or destroy any file the host process can touch. The api/api.py wiki-cache endpoint builds filesystem paths directly from user-supplied owner, repo, and repo_type values without sanitization, and a second unauthenticated directory-creation endpoint completes the primitive so an attacker can traverse out of the cache directory. With no authentication (PR:N) and root-level execution, this is a direct path to full host compromise; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated arbitrary file read in DeepWiki-Open (AsyncFuncAI) through commit d92819a lets anyone who can reach the /ws/chat WebSocket endpoint pass an arbitrary directory path as the repo_url parameter and have the server walk that path with no containment check, exfiltrating every readable Python, JavaScript, YAML and JSON file it finds. Because the read is aimed at source and configuration files, the practical payoff is hardcoded secrets, API keys and credentials rather than code execution. A public proof of concept is indicated by SSVC exploitation status and the flaw is fully automatable, though it is not listed in CISA KEV as actively exploited.
Unauthenticated remote directory listing in deepwiki-open through commit 16f35a0 allows any network-accessible attacker to enumerate arbitrary filesystem paths on the host by supplying absolute path parameters to the local-repository structure endpoint. The root cause is a combination of missing input path restriction (CWE-22) and an authentication layer that is disabled by default (WIKI_AUTH_MODE=false), meaning every default deployment is immediately vulnerable without any configuration change. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any internet-exposed instance.
Arbitrary file write and delete as root in AsyncFuncAI DeepWiki-Open (through commit 16f35a0) lets unauthenticated remote attackers corrupt, overwrite, or destroy any file the host process can touch. The api/api.py wiki-cache endpoint builds filesystem paths directly from user-supplied owner, repo, and repo_type values without sanitization, and a second unauthenticated directory-creation endpoint completes the primitive so an attacker can traverse out of the cache directory. With no authentication (PR:N) and root-level execution, this is a direct path to full host compromise; no public exploit identified at time of analysis and it is not listed in CISA KEV.