CVE-2026-103591 — DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file
DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can su…
Published: 2026-09-30 · CVSS: 8.7 · CVSS 4.0
DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7