Live › vulnerability › CVE-2026-120501
Otter Wiki versions from 2.20.1 before 2.26.2 let anyone who can edit pages embed a DataTable pointing at an absolute path such as /.git/config. The file is rendered as a table, so an attacker can read repository-internal files, including any stored remote credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Teams running a self-hosted Otter Wiki between 2.20.1 and 2.26.2. Anonymous editing is allowed under the default configuration, so exposure is highest on public instances; instances where only trusted accounts can edit are at lower risk. Hosted or unrelated wikis can skip it.
No product ranges from the sources yet.
2.20.1 to 2.26.2.2.26.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-120501")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.