Danswer 访问控制错误漏洞

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. An access control error vulnerability exists in Danswer version v0.3.94 that stems from the application not validating the file creator, which could allow an attacke...

PT-2025-12288

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94 Description The issue allows attackers to bypass the visibility restriction set by administrators for the search page. When the search page is set to be invisible, regular users cannot view it or access its...

PT-2025-12197

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer versions prior to the fixed version Description An arbitrary file overwrite issue exists in the ZulipConnector, arising from the load credentials method. This method uses user-controlled input for realm name and zuliprc...

PT-2025-12299

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.9.0 Description The issue arises from the use of a vulnerable version of the starlette package =0.49 via fastapi, which was patched in fastapi version 0.115.3. This can be exploited by sending multiple requests to...

PT-2025-12289

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94 Description The issue allows an attacker to view any files due to a lack of verification of whether the attacker is the creator of the file. This can be exploited by directly calling the GET /api/chat/file/fil...

PT-2025-12193

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 1 Description A vulnerability allows an attacker to perform a Regular Expression Denial of Service ReDoS by manipulating regular expressions. This can significantly slow down the application's response time and...