A critical, unauthenticated path traversal vulnerability in AsyncFuncAI deepwiki-open enables remote attackers to manipulate files on the host system with root-level impact.

The wiki-cache endpoint fails to sanitize user-supplied input for owner, repo, and repo_type fields, which permits path traversal attacks by unauthenticated remote users.

This vulnerability allows unauthenticated attackers to gain total control over the server filesystem, including the ability to overwrite system binaries or exfiltrate sensitive data. With a CVSS score of 9.8, the potential for total system compromise is extreme, posing a catastrophic risk to data confidentiality, integrity, and availability.

Immediate Action: Since no specific patch version is currently listed, restrict network access to the affected service and disable the wiki-cache functionality until a security update is released by the vendor.

Proactive Monitoring: Monitor server logs for suspicious URL patterns containing directory traversal sequences, such as dot-dot-slash characters, targeting the wiki-cache endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to block incoming requests containing path traversal sequences directed at the application.

Public Exploit Available: Unknown

Given the critical nature of this flaw and the lack of a verified patch, immediate isolation of the application from public-facing networks is required. Security teams should prioritize identifying alternative solutions or applying strict access controls until the vendor provides a remediation update.