Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-72602— AsyncFuncAI deepwiki-open - Path Traversal

Quick assessment

Affected
AsyncFuncAI deepwiki-open
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ASYNCFUNC DeepWiki-Open是ASYNCFUNC组织的一款维基文档管理软件 ASYNCFUNC DeepWiki-Open 16f35a0及之前版本存在路径遍历漏洞，该漏洞源于路径遍历问题，本地仓库结构端点接受绝对文件系统路径参数，在WIKI_AUTH_MODE默认为false时未经验证返回目录列表，可能导致未经身份验证的远程攻击者枚举主机系统上的敏感目录内容。

CVSS 7.5 · High EPSS 0.74% · P53

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery

Affected Version Matrix 1

VendorProduct Version RangeStatus
AsyncFuncAI deepwiki-open ≤ 16f35a0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72602

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AsyncFuncAI deepwiki-open - Path Traversal
Source: CVE Program / CVE List V5
Vulnerability Description
A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and returns a directory listing without authentication, as WIKI_AUTH_MODE defaults to false. An attacker can enumerate sensitive directory contents on the host system.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
ASYNCFUNC DeepWiki-Open 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ASYNCFUNC DeepWiki-Open是ASYNCFUNC组织的一款维基文档管理软件 ASYNCFUNC DeepWiki-Open 16f35a0及之前版本存在路径遍历漏洞，该漏洞源于路径遍历问题，本地仓库结构端点接受绝对文件系统路径参数，在WIKI_AUTH_MODE默认为false时未经验证返回目录列表，可能导致未经身份验证的远程攻击者枚举主机系统上的敏感目录内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
AsyncFuncAI deepwiki-open 0 ~ 16f35a0 -

II. Public POCs for CVE-2026-72602

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 7403 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-72602

请登录查看更多情报信息。

Other References for CVE-2026-72602 (1)

IV. Related Vulnerabilities

Same product: deepwiki-open
Same vendor: AsyncFuncAI
Same weakness: CWE-22

V. Comments for CVE-2026-72602

No comments yet

Leave a comment