CVE-2026-72567 in deepwiki-open
Summary
by MITRE • 08/10/2026
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal. A second unauthenticated endpoint creates directories, and combined these primitives allow arbitrary file write and delete as the root process user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability resides within the AsyncFuncAI/deepwiki-open application, specifically in the api/api.py file where the wiki-cache endpoint processes user input without proper sanitization or validation. The flaw manifests as an improper path validation issue that enables attackers to manipulate file system operations through crafted requests. The vulnerability is rooted in the application's failure to validate or sanitize the owner, repo, and repo_type parameters that are directly used to construct file paths, creating a classic path traversal condition that can be exploited by unauthenticated remote adversaries.
The technical exploitation occurs through two distinct but complementary attack vectors that together create a complete arbitrary file manipulation capability. The first vector involves the wiki-cache endpoint which accepts user-controlled input and uses it to build file paths without any validation or sanitization measures, allowing attackers to construct malicious paths that traverse directories beyond the intended scope. The second vector is an unauthenticated directory creation endpoint that enables attackers to establish directory structures in locations where they might not otherwise have write permissions, but when combined with the path traversal vulnerability, allows complete control over file system operations as the root process user.
The operational impact of this vulnerability is severe and far-reaching, as it grants remote attackers complete control over the application's file system with root privileges. Attackers can leverage this vulnerability to write arbitrary files to any location on the system, potentially deploying malicious code, modifying critical application components, or exfiltrating sensitive data. Additionally, the ability to delete arbitrary files provides attackers with destructive capabilities that could compromise system integrity and availability. The vulnerability affects all users of the deepwiki-open application, as no authentication is required to exploit these endpoints, making it particularly dangerous in publicly accessible environments.
Mitigation strategies should focus on implementing robust input validation and sanitization mechanisms throughout the application's codebase. All user-controlled parameters that influence file system operations must undergo strict validation to ensure they conform to expected patterns and do not contain path traversal sequences such as '../' or similar malicious constructs. The implementation of a whitelist-based approach for acceptable values in owner, repo, and repo_type fields would significantly reduce the attack surface. Additionally, privilege separation should be enforced where possible, ensuring that application processes run with minimal required permissions rather than root privileges. Organizations should also implement proper access controls and authentication mechanisms to prevent unauthorized access to administrative endpoints, while regular security audits and code reviews should be conducted to identify similar vulnerabilities in other parts of the application. This vulnerability aligns with CWE-22 Path Traversal and CWE-73 Path Traversal, and maps to ATT&CK techniques including T1059 Command and Scripting Interpreter and T1078 Valid Accounts for maintaining persistent access.
The vulnerability demonstrates a critical failure in secure coding practices and highlights the importance of defense-in-depth strategies. Organizations should implement automated security scanning tools that can detect path traversal vulnerabilities during development and deployment phases, while also establishing comprehensive monitoring systems to detect anomalous file system operations that might indicate exploitation attempts. Regular security training for developers on secure coding practices and common vulnerability patterns is essential to prevent similar issues from occurring in future releases. The combination of weak input validation with elevated privileges creates a particularly dangerous scenario where minimal effort can result in complete system compromise, emphasizing the need for proactive security measures rather than reactive remediation approaches.