Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Otter Wiki lets editors read internal files

CVE-2026-120501 · published 2 days ago
Summary

Versions of Otter Wiki before 2.26.2 let anyone who can edit a page—including anonymous users under the default settings—display any file from the server by embedding its path in a table. This can expose configuration files such as .git/config that may contain credentials. Upgrade to version 2.26.2 or later, or restrict page editing to trusted users, to stop the exposure.

What to do
  • Update redimp otterwiki to version 2.26.2 or later.
Affected software
VendorProductAffected versions
redimp otterwiki < 2.26.2
Original advisory text
An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src
An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-552Files or Directories Accessible to External Parties
Timeline
Published2 Nov 2026
Updated3 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-120501 · NVD
CVE-2026-120501 · MITRE
CVE-2026-120501 · OSV
Track software like this
Free during beta