CVE-2026-103591: Asyncfuncai Deepwiki-Open

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths.

Affected products

• Asyncfuncai Deepwiki-Open

Published 2026-09-30. Last modified 2026-10-02.