Otterwiki
Monthly
Repository-internal file disclosure in Otter Wiki 2.20.1 through 2.26.1 lets anyone who can edit a wiki page read files stored inside the application's own repository - most critically .git/config, which frequently holds remote URLs with embedded credentials - by passing an absolute src (for example /.git/config) to the DataTable embedding, which resolves the path and renders the file contents as a table. Under the default configuration anonymous visitors can edit pages, so the CVSS vectors carry PR:N and no account is needed; instances that disable anonymous editing or restrict edit rights require a valid account with edit permission instead. Impact is bounded to reading repository-internal files (confidentiality only, no write or denial-of-service effect), scoring 6.9 under CVSS 4.0 and 5.3 under the assessed CVSS 3.1 vector; there is no CISA KEV listing and no public exploit identified at time of analysis, while a vendor fix is available in 2.26.2.
Stored cross-site scripting in Otter Wiki before 2.26.2 lets anyone able to edit a page - including anonymous users under the default configuration - persist HTML and script inside a ```math fenced code block that the renderer emits without escaping, so the payload executes in the browser of every viewer who opens the poisoned page. Successful exploitation requires the victim to view the page (passive user interaction) and grants script execution in the wiki's origin in a scope-changed context, with low confidentiality and integrity impact on the viewer's session rather than on the server. This is a genuine but moderate-priority issue, not an emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with a vendor fix released in 2.26.2.
Repository-internal file disclosure in Otter Wiki 2.20.1 through 2.26.1 lets anyone who can edit a wiki page read files stored inside the application's own repository - most critically .git/config, which frequently holds remote URLs with embedded credentials - by passing an absolute src (for example /.git/config) to the DataTable embedding, which resolves the path and renders the file contents as a table. Under the default configuration anonymous visitors can edit pages, so the CVSS vectors carry PR:N and no account is needed; instances that disable anonymous editing or restrict edit rights require a valid account with edit permission instead. Impact is bounded to reading repository-internal files (confidentiality only, no write or denial-of-service effect), scoring 6.9 under CVSS 4.0 and 5.3 under the assessed CVSS 3.1 vector; there is no CISA KEV listing and no public exploit identified at time of analysis, while a vendor fix is available in 2.26.2.
Stored cross-site scripting in Otter Wiki before 2.26.2 lets anyone able to edit a page - including anonymous users under the default configuration - persist HTML and script inside a ```math fenced code block that the renderer emits without escaping, so the payload executes in the browser of every viewer who opens the poisoned page. Successful exploitation requires the victim to view the page (passive user interaction) and grants script execution in the wiki's origin in a scope-changed context, with low confidentiality and integrity impact on the viewer's session rather than on the server. This is a genuine but moderate-priority issue, not an emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, with a vendor fix released in 2.26.2.