Description

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T18:20:29.180Z",
  "pubdate": "2026-09-14T18:20:29.180Z",
  "executiveSummary": "DeepWiki-Open, through commit d92819a, is susceptible to an arbitrary file read vulnerability residing within its WebSocket communication interface. The flaw allows unauthenticated remote attackers to access sensitive files from the underlying filesystem by manipulating the 'repo_url' parameter.\nThis vulnerability is classified as an improper path validation issue, enabling unauthorized directory traversal. By providing arbitrary system paths, an attacker can exfiltrate sensitive data, including configuration files, source code, and hardcoded credentials stored in extensions such as Python, JavaScript, YAML, and JSON.\nThe risk implication is critical, as it bypasses standard access control mechanisms and facilitates full information disclosure of the server's internal files. The attack requires no authentication, making the endpoint publicly accessible to any entity capable of establishing a WebSocket connection. Exploitation results in immediate exposure of intellectual property and potential compromise of upstream infrastructure or integrated services through stolen secrets.",
  "technicalDetails": "The vulnerability is located in the '/ws/chat' WebSocket endpoint, which fails to adequately sanitize or validate the 'repo_url' input parameter before utilizing it in filesystem operations. The application accepts this parameter as a path to a repository; however, the lack of containment or canonicalization checks allows the input to traverse outside of the intended directory structure.\nThe root cause of this vulnerability is the trust placed in user-supplied input during filesystem access operations. By manipulating the 'repo_url' string, an attacker can perform path traversal attacks using sequences like '../' to escape the application root and access arbitrary locations on the server's filesystem.\nThe attack flow begins when an attacker initiates a WebSocket connection to the '/ws/chat' endpoint. Upon successful connection, the attacker transmits a crafted message containing a malicious 'repo_url' payload. The backend application, failing to enforce path boundaries, passes this unsanitized path directly to an internal file-reading function. The application then attempts to parse the content of the specified file—specifically targeting supported formats such as .py, .js, .yaml, and .json—and returns the file contents over the active WebSocket stream.\nBecause the service operates without authentication, an attacker does not require valid credentials or session tokens to interact with the vulnerable endpoint. This exposes the server to mass exfiltration of sensitive information, including environment variables, API keys, database connection strings, and backend source code contained within the targeted extensions.\nPost-exploitation, the attacker gains significant insight into the system architecture and internal logic, which can be leveraged to escalate the attack surface. For example, if database credentials or secret keys are recovered, the attacker could gain unauthorized access to connected databases or sign forged authentication tokens, leading to a complete compromise of the platform's security boundary."
}