CVE-2026-103591

Summary

The vulnerability allows attackers to read any file accessible to the API process by supplying an absolute file path through the repo_url parameter in the GET /codemap/file endpoint. This bypasses path containment checks and can lead to sensitive data exposure.

Exploitability

Exploitation is straightforward with no authentication required, needing only a request to the vulnerable endpoint with a crafted absolute file path in the repo_url parameter.

Blast radius

The impact could be significant as attackers may access configuration files, credentials, or source code that the API process can read, potentially leading to further system compromise.

Detection

Monitor for GET requests to /codemap/file endpoint with repo_url parameter containing absolute paths (starting with /) in application logs, particularly those that attempt to access system files like /etc/passwd or configuration files.

Prioritized remediation

Upgrade to DeepWiki-Open version 2.590 or later to address this arbitrary file read vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.