CVE-2026-103591

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths.

  • Published Sep 30, 2026
  • CVSS 8.7 high
  • 0.4% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-103591 at the National Vulnerability Database