CVE-2026-72567 AsyncFuncAI CVE debrief

Who should care

Organizations using AsyncFuncAI/deepwiki-open through commit 16f35a0 should prioritize patching this vulnerability to prevent potential exploitation. Additionally, security teams and administrators responsible for maintaining systems with this software should be aware of the vulnerability and take necessary precautions to mitigate the risk.

Technical summary

CVE-2026-72567 is a critical vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0. The vulnerability is caused by improper path validation in the api/api.py wiki-cache endpoint, which constructs file paths from user-controlled owner, repo, and repo_type fields without sanitization, enabling path traversal. This allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The CVSS score is 9.8, indicating a high severity.

Defensive priority

CVE-2026-72567 is rated CRITICAL with a CVSS score of 9.8. Unaunthenticated remote path traversal vulnerability allows attackers to write to or delete arbitrary files with root privileges.

Recommended defensive actions

• Review and update AsyncFuncAI/deepwiki-open to ensure the latest security patches are applied
• Implement additional monitoring and logging to detect potential exploitation attempts
• Restrict access to the api/api.py wiki-cache endpoint to only trusted users and networks
• Consider implementing a Web Application Firewall (WAF) to detect and prevent path traversal attacks
• Perform a thorough inventory of systems and networks that may be affected by this vulnerability

Evidence notes

The CVE-2026-72567 record indicates a critical vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0. The vulnerability is caused by improper path validation in the api/api.py wiki-cache endpoint, which constructs file paths from user-controlled fields without sanitization, enabling path traversal. The CVSS score is 9.8, indicating a high severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.