Improper Path Validation in DeepWiki Open by AsyncFuncAI

CVE-2026-72567

What is CVE-2026-72567?

The deepwiki-open product by AsyncFuncAI is vulnerable to an improper path validation issue due to the way it handles user input in the api/api.py file. Specifically, the wiki-cache endpoint constructs file paths using user-controlled fields (owner, repo, and repo_type) without adequate sanitization. This oversight allows unauthenticated remote attackers to exploit the vulnerability, potentially enabling them to write to or delete arbitrary files on the server with root privileges, leading to significant security risks.

References