AsyncFuncAI deepwiki-open contains a critical path traversal flaw in the wiki-cache endpoint, where the API concatenates user‑controlled owner, repo, and repo_type fields to build file paths without sanitization. An unauthenticated attacker can craft payloads such as '../../../../etc/passwd' to manipulate the resulting path, enabling the creation, modification, or deletion of any file on the host system. The underlying process runs with root privileges, so the attacker gains full system compromise, including confidentiality, integrity, and availability violations.

Any deployment of AsyncFuncAI deepwiki-open that incorporates the vulnerable code branch containing commit 16f35a0 or any subsequent builds that have not yet applied a fix is affected. The attack vector relies on the exposed wiki-cache and directory‑creation endpoints; therefore installations that expose these endpoints to external networks are at risk, regardless of the operating system on which the application runs.

The CVSS score of 9.8 reflects a critical severity, and the flaw requires no authentication. It is inferred from the description that, because authentication is not required, an attacker able to reach the exposed endpoints from any network location can launch the exploitation. EPSS data is not available, but the simplicity of the path traversal and the root privileges of the process suggest a high likelihood of successful exploitation. The vulnerability is not listed in the CISA KEV catalog, however its impact and ease of exploitation make it a high‑prioritization risk.