Deepwiki Open
Approved changes feed: RSS · Atom
cpe:2.3:a:asyncfuncai:deepwiki-open:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Asyncfuncai (f76a3095-72e4-53cd-bf95-5c0a06c26ac5) |
|---|---|
| Product | Deepwiki Open (f996c029-1343-5875-85b2-c4b37a89e8d8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72567 |
vulnerable | 2026-09-16 04:33:09.422646 |
deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete
CRITICAL (9.8)
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal.
Published: 2026-08-10T10:40:37.428Z
Updated: 2026-08-10T13:07:13.890Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72602 |
vulnerable | 2026-09-16 04:33:09.155664 |
AsyncFuncAI deepwiki-open - Path Traversal
HIGH (7.5)
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and returns a directory listing without authentication, as WIKI_AUTH_MODE defaults to false. An attacker can enumerate sensitive directory contents on the host system.
Published: 2026-08-11T11:14:58.046Z
Updated: 2026-08-11T12:13:06.483Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-90946 |
vulnerable | 2026-09-16 04:33:05.554733 |
DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
HIGH (7.5)
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.
Published: 2026-09-14T17:52:06.851Z
Updated: 2026-09-24T14:22:06.565Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.