CVE-2026-72567
CriticalCVSS 9.8Summary
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The wiki-cache endpoint constructs file paths from user-controlled fields without sanitization, enabling path traversal.
Risk Assessment
The risk includes full system compromise by writing or deleting files with root privileges, potentially leading to complete takeover.
Recommendation
Immediately update deepwiki-open to a patched version and implement input validation for owner, repo, and repo_type fields.
Original NVD description (English source)
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal.