Is CVE-2026-103591 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-103591?

CVE-2026-103591 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-103591

Description

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths.