CVE-2026-120501

The record

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials.

Affected packages

Related vulnerabilities

• CVE-2026-84172 Files accessible to external parties in Apache Wicket. CWE-552
• CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-552
• CVE-2026-119201 Nuxt is an open-source web development framework for Vue.js. CWE-552
• CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control… CWE-552
• CVE-2026-65210 This issue may allow an authenticated IPMI Administrator to read arbitrary files from the… CWE-552
• CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-552
• CVE-2026-114400 Trudesk through 1.2.11 contains a missing authentication vulnerability that allows… CWE-552
• CVE-2026-87348 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… CWE-552