DeepWiki-Open: Unauthenticated arbitrary file read via codemap file endpoint

Summary

DeepWiki-Open, an AI tool that generates documentation wikis from code repositories, contains an unauthenticated arbitrary file read vulnerability in its GET /codemap/file endpoint. By supplying a non-URL value for the repo_url parameter, an attacker can bypass path containment checks and read any file the API process can access by using absolute file paths. Exploitation requires only network access to the service and no credentials. The realistic impact is disclosure of secrets such as API keys, service account files or configuration held by the process.

Affected

• deepwiki-open through commit d92819a (no release versions published; affected status is defined by commit hash)
• CVSS 4.0 base score 8.7 (High), vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Fixed in

Unknown. No fixed version or commit has been published.

Workaround

• No vendor workaround documented.
• Restrict access to the service via VPN, internal network or IP allowlist.
• Place a reverse proxy with authentication in front of the service. Enabling the project's auth mode does not mitigate this issue.

Exploitation

• Not listed in CISA KEV; EPSS below 1%.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• No public proof of concept found; status treated as unknown rather than confirmed absent.

Our recommendation

• Check whether any DeepWiki-Open instance is reachable from the internet or untrusted networks and take it offline or restrict it immediately.
• Run the service in a container or account without access to secrets, credentials or other repositories.
• Review web and API logs for requests to /codemap/file.
• If exposure is suspected, rotate credentials the process could read.
• Monitor the project repository and issue #590 for a fix; do not assume later commits are fixed until the maintainers confirm it.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-103591 on OpenCVE app.opencve.io
• VulnCheck advisory www.vulncheck.com
• DeepWiki-Open issue #604 github.com
• DeepWiki-Open issue #536 github.com
• DeepWiki-Open security tab github.com
• DeepWiki-Open issue #590 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:24.