CVE-2026-72567 — deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with …
Published: 2026-08-10 · CVSS: 9.8 · CVSS 3.1
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7