---
id: CVE-2026-120501
title: >-
  An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable
  src
summary: >-
  An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in
  the DataTable embedding that allows attackers who can edit pages, including
  anonymous users under the default configuration, to read repository-internal
  files…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-552
vendor: redimp
product: otterwiki
affected:
  - otterwiki >= 2.20.1 < 2.26.2
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T15:31:37.074Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120501'
references:
  - url: >-
      https://github.com/redimp/otterwiki/commit/263cac4981f60d92c46adf6386591cf4bc4d6835
  - url: 'https://github.com/redimp/otterwiki/releases/tag/v2.26.2'
    label: otterwiki v2.26.2 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/an-otter-wiki-2.20.1-before-2.26.2-repository-file-disclosure-via-datatable-src
    label: >-
      VulnCheck Advisory: An Otter Wiki 2.20.1 before 2.26.2 Repository File
      Disclosure via DataTable src
tags:
  - cve.org
epss: 0.00297
epssPercentile: 0.22513
ingestedAt: '2026-11-05T19:30:42.692Z'
---

## Overview

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to render the file as a table, exposing any stored remote credentials.

## Affected

- `otterwiki >= 2.20.1 < 2.26.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.