CVE-2026-72567: deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype fields without sanitization, enabling path traversal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsyncFuncAI/deepwiki-opento a version that resolves this vulnerability.Patch 16f35a0 - Compensating control
Limit network access to the deepwiki-open api/api.py wiki-cache endpoint (e.g., restrict to trusted IPs) to reduce exposure to unauthenticated path traversal until patched.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72567?
CVE-2026-72567 has a critical severity rating of 9.8.
How do I fix CVE-2026-72567?
To fix CVE-2026-72567, ensure proper path validation to prevent unauthorized file access by restricting user inputs.
What type of vulnerability is CVE-2026-72567?
CVE-2026-72567 is classified as a Path Traversal vulnerability.
Who can exploit CVE-2026-72567?
CVE-2026-72567 can be exploited by unauthenticated remote attackers.
What are the potential impacts of CVE-2026-72567?
The impacts of CVE-2026-72567 include the ability for attackers to write to or delete arbitrary files with root privileges.