CVE-2026-72567

Name of the Vulnerable Software and Affected Versions AsyncFuncAI/deepwiki-open versions prior to commit 16f35a0

Description Improper path validation allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The 'api/api.py' wiki-cache endpoint constructs file paths using the owner, repo, and repo type fields without proper sanitization, which enables path traversal. Path traversal is a technique used to access files and directories that are stored outside the web root folder. Additionally, a second unauthenticated endpoint allows the creation of directories; when combined, these capabilities enable arbitrary file write and delete operations as the root process user.

Recommendations Update AsyncFuncAI/deepwiki-open to a version beyond commit 16f35a0. Restrict access to the 'api/api.py' wiki-cache endpoint to minimize the risk of exploitation.