File Disclosure Vulnerability in Otter Wiki by Redimp
CVE-2026-120501

6.9MEDIUM

Key Information:

Vendor

Redimp

Status
Otterwiki
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120501?

Otter Wiki versions prior to 2.26.2 are susceptible to a file disclosure vulnerability stemming from the DataTable embedding feature. This weakness enables malicious users, including anonymous visitors with default settings, to access sensitive internal files from the repository. By manipulating the source of the DataTable, attackers can exploit this vulnerability to render files such as /.git/config in a table format, thereby exposing critical information including remote credentials. Admins are encouraged to upgrade to the latest version to mitigate the risk.

Affected Version(s)

otterwiki 2.20.1 < 2.26.2

References

https://github.com/redimp/otterwiki/commit/263cac4981f60d...
patch
https://github.com/redimp/otterwiki/releases/tag/v2.26.2
release-notes
https://www.vulncheck.com/advisories/an-otter-wiki-2.20.1...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
Ralph Thesen
.