CyberRota Analysis
AI-GeneratedThe arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint of DeepWiki-Open allows attackers to exploit the repo_url parameter to access sensitive files across the filesystem, including those containing hardcoded secrets and credentials. This poses a significant risk to applications utilizing Java, particularly in environments where sensitive data may be exposed. Organizations using this software should prioritize remediation to prevent potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.