Executive brief
DeepWiki is an open-source AI-powered wiki generator that processes GitHub/GitLab/Bitbucket repositories. An unauthenticated attacker can exploit improper path validation in the wiki-cache API endpoint to write or delete arbitrary files on the server with root privileges, potentially compromising the entire system and all data it manages.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the api/api.py wiki-cache endpoint. The endpoint constructs file system paths from user-supplied owner, repo, and repo_type parameters without proper sanitization or validation, allowing attackers to inject path traversal sequences (e.g., ../) to access arbitrary locations. No authentication is required; the attack is performed over the network. An attacker can read, write, or delete files anywhere on the filesystem with the privileges of the application process (root). A patch should implement strict path validation, sanitization of user inputs, or use a safer file handling approach with chroot/jail containment.
Affected products
- AsyncFuncAI deepwiki-open through commit 16f35a0
Timeline
- 2026-08-10: disclosed