CVE-2026-120501 in OtterWiki
Summary
by MITRE • 11/02/2026
An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The identified vulnerability in Otter Wiki versions prior to 2.26.2 represents a critical information disclosure flaw rooted in improper input validation within the DataTable embedding functionality. This security weakness allows authenticated users with page editing privileges, and notably anonymous users under default configuration settings, to access sensitive files stored within the application's repository directory structure. The core technical failure lies in how the system processes source paths for embedded data tables; specifically, it fails to restrict or sanitize absolute file path inputs provided by the user. By leveraging this lack of validation, an attacker can construct a malicious request that instructs the server to read and render arbitrary files from the local filesystem as table content rather than treating them strictly as external web resources.
From a technical perspective, the exploitation mechanism relies on setting the source attribute of a DataTable embedding to an absolute path pointing to internal configuration or credential storage locations. A prime example cited in vulnerability reports is targeting /.git/config, which typically contains remote repository URLs including embedded authentication tokens such as usernames and passwords for private repositories like GitHub or GitLab. When this file is rendered via the vulnerable component, its contents are exposed directly within the web interface, effectively bypassing standard access controls that would normally prevent public users from viewing server-side configuration files. This behavior indicates a failure to implement proper path traversal protections or directory restriction mechanisms commonly expected in content management systems handling user-generated embeds.
The operational impact of this vulnerability is severe due to the potential for credential theft and subsequent lateral movement within an organization's infrastructure. Exposure of remote repository credentials can lead directly to unauthorized access to source code repositories, intellectual property theft, and further exploitation through supply chain attacks if those repositories contain sensitive application logic or deployment scripts. Furthermore, because anonymous users are affected under default configurations, the attack surface is significantly expanded, allowing unauthenticated adversaries to perform reconnaissance and data exfiltration without needing valid user accounts. This aligns with common patterns of insecure direct object references where internal resources are exposed through manipulated identifiers or paths that lack proper authorization checks.
In terms of industry classification standards, this vulnerability maps closely to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory. The exploitation technique also reflects aspects of ATT&CK tactic T1005: Data from Local System, specifically the subtechnique for file discovery where attackers probe local directories to gather intelligence necessary for further compromise. The ability to read arbitrary files via a web interface component underscores the importance of strict input validation and output encoding in all user-facing features that interact with server-side resources.
To mitigate this risk, organizations running Otter Wiki versions before 2.26.2 should immediately upgrade to the patched version where these path handling restrictions have been implemented. In environments where upgrading is not immediately feasible, administrators can apply compensating controls by restricting page editing permissions to trusted users only and disabling anonymous access entirely through configuration changes. Additionally, implementing web application firewall rules that detect attempts to embed absolute paths in DataTable parameters may provide an additional layer of defense against exploitation until the software update is applied. Regular auditing of embedded content configurations and ensuring that sensitive files like .git/config are not stored in accessible directories remain essential best practices for maintaining secure wiki deployments.