CVE-2026-90946: DeepWiki-Open Path Traversal Vulnerability

CVE-2026-90946 Overview

CVE-2026-90946 is an arbitrary file read vulnerability in DeepWiki-Open through commit d92819a. The flaw exists in the unauthenticated /ws/chat WebSocket endpoint, which accepts a repo_url parameter as a filesystem path with no containment or validation. Attackers can supply arbitrary directory paths to read files with supported extensions, including Python, JavaScript, YAML, and JSON files. These files frequently contain hardcoded secrets, API keys, and credentials. The vulnerability maps to CWE-73: External Control of File Name or Path and requires no authentication, no user interaction, and can be exploited remotely over the network.

Critical Impact
Unauthenticated remote attackers can harvest sensitive source files and hardcoded credentials from any readable directory on the host running DeepWiki-Open.

Affected Products

DeepWiki-Open through commit d92819a
Deployments exposing the /ws/chat WebSocket endpoint to untrusted networks
Self-hosted DeepWiki-Open instances built from the AsyncFuncAI deepwiki-open repository

Discovery Timeline

2026-09-14 - CVE-2026-90946 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90946

Vulnerability Analysis

DeepWiki-Open exposes a WebSocket endpoint at /ws/chat that accepts a repo_url value from unauthenticated clients. The server treats this value as a local filesystem path rather than validating it as a repository URL. The application then enumerates the referenced directory and reads any file matching a supported extension list, returning contents through the chat channel. Because there is no authentication, no path canonicalization, and no restriction to a trusted base directory, the endpoint operates as a broad file read primitive. Sensitive artifacts such as .env files, JSON configuration, and YAML deployment manifests fall directly within the supported extension set.

Root Cause

The root cause is external control of a file path parameter without containment, classified as CWE-73. The repo_url field is designed for remote repository identifiers but is dispatched to filesystem enumeration logic in the api/repository.py and api/data_pipeline.py modules. See the Repository Script and Data Pipeline Script for the affected code paths.

Attack Vector

An attacker opens a WebSocket connection to /ws/chat on an exposed DeepWiki-Open instance. The attacker submits a chat message where repo_url is set to an absolute filesystem path such as /etc, /root, or an application working directory. The server walks the path, reads every file whose extension is in the allowed set, and streams the contents back. No credentials, tokens, or prior session state are required. Additional context is available in the VulnCheck Advisory on DeepWiki and GitHub Issue #536.

No verified public exploit code is available. Refer to the linked advisories for technical reproduction details.

Detection Methods for CVE-2026-90946

Indicators of Compromise

WebSocket connections to /ws/chat originating from unexpected external IP addresses.
repo_url values in DeepWiki-Open request logs that contain absolute filesystem paths, .. sequences, or references to sensitive directories such as /etc, /root, /home, or application config folders.
Anomalous outbound WebSocket frame sizes indicating bulk file content exfiltration.
Access log entries showing repeated /ws/chat sessions from a single source within a short window.

Detection Strategies

Inspect reverse proxy and application logs for /ws/chat requests whose payloads contain filesystem path patterns rather than valid Git URLs.
Deploy WebSocket-aware Web Application Firewall (WAF) rules that reject repo_url values not matching an allowlist of Git hosting hostnames.
Correlate spikes in file system read activity by the DeepWiki-Open process with concurrent inbound WebSocket sessions.

Monitoring Recommendations

Ingest DeepWiki-Open application, reverse proxy, and process telemetry into a centralized logging platform for correlation across identity, network, and host layers.
Alert on the DeepWiki-Open service process reading files outside its expected repository cache directory.
Monitor egress bandwidth from hosts running DeepWiki-Open for sustained WebSocket traffic that could indicate large-scale file extraction.

How to Mitigate CVE-2026-90946

Immediate Actions Required

Restrict network exposure of DeepWiki-Open so the /ws/chat endpoint is not reachable from untrusted networks.
Place the service behind an authenticating reverse proxy that terminates WebSocket connections and enforces access control.
Rotate any secrets, API tokens, or credentials that were stored in files readable by the DeepWiki-Open process.
Audit host filesystems for files that may have been enumerated and exfiltrated through the vulnerable endpoint.

Patch Information

At publication, no official fixed release is referenced in the NVD entry for DeepWiki-Open. Track remediation status through the upstream GitHub Project Repository and GitHub Issue #536. Rebuild from a commit that validates repo_url as a remote Git URL and constrains filesystem access to a dedicated cache directory.

Workarounds

Apply an application-layer input filter that rejects any repo_url value not matching an allowlist of hosted Git providers such as github.com, gitlab.com, or an internal SCM hostname.
Run DeepWiki-Open under a dedicated low-privilege service account with filesystem access limited to its working directory using operating system controls or container mounts.
Deploy the application inside a container with a read-only root filesystem and a narrowly scoped writable volume for repository data.
Enforce network segmentation with firewall rules that permit /ws/chat connections only from trusted management ranges.

bash

# Example nginx snippet restricting /ws/chat to a trusted CIDR
location /ws/chat {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://deepwiki_upstream;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}