CVE-2026-103591

Name of the Vulnerable Software and Affected Versions DeepWiki-Open versions prior to commit d92819a

Description An unauthenticated arbitrary file read issue exists in the 'GET /codemap/file' endpoint. By providing a non-URL value to the repo url parameter, an attacker can bypass path containment checks and read any file accessible to the API process using absolute file paths.

Recommendations Update DeepWiki-Open to commit d92819a or a later version. As a temporary mitigation, restrict access to the 'GET /codemap/file' endpoint or avoid using the repo url parameter until the update is applied.