PT-2026-70911

kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unauthenticated GET /addTask endpoint in kkFileView is omitted from TrustHostFilter and TrustDirFilter in server/src/main/java/cn/keking/config/WebConfig.java, allowing FileConvertQueueTask to fetch an...

CVE-2026-70486

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

GHSA-3XPF-XQ7R-V8C5 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Summary Any authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is serv...

CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-70486

Open WebUI (self-hosted AI platform) versions 0.9.0–0.11.0 contain a Same-Origin/XSS risk in the terminal file-preview iframe: the serveUrl iframe branch granted allow-same-origin and allow-scripts for HTML files from the app origin, enabling an authenticated user with terminal server access to r...

CVE-2026-70486 Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user wi...

CVE-2026-57917

CVE-2026-57917 affects proCertum SmartSign. The issue is an XML External Entity (XXE) vulnerability where external entities are parsed from crafted signature files, enabling SSRF and potentially local file reads depending on parser configuration. The vulnerability is triggered by previewing a fil...

EUVD-2026-49136

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...

CVE-2026-40000

The CVE-2026-40000 entry concerns ZTE File Manager’s Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity, used to preview compressed files. Third-party apps can launch this Activity and supply arbitrary file paths (e.g., content://zte.com.cn.filer.fileprovider/root_path), allowing acce...

CVE-2026-40000 Path Traversal Vulnerability in ZTE Blade A75 5G

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...

PT-2026-64874

Name of the Vulnerable Software and Affected Versions ZTE File Manager affected versions not specified Description The zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity activity is intended to preview compressed files. Third-party applications can launch this activity and provide arbitrary fi...

PYSEC-2026-2731 Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Related advisory This advisory tracks a regression of the original Excel-preview XSS that was publicly disclosed and patched under GHSA-jwf8-pv5p-vhmc patched in v0.8.0. The same root cause — XLSX.utils.sheettohtml output rendered via @html excelHtml without DOMPurify — was reintroduced sometime...

PT-2026-50483

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The application renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel:...

Gogs: Overwriting critical files results in a denial of service

Vulnerability type: Path Traversal Impact: DoS Exploitation prerequisite: authorized user Description: As an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the...

CVE-2026-41980

Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-41980

Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

EUVD-2026-35341

Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-41980

Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-41980

Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-41980

Technical details are not publicly available in the provided documents. This CVE entry lacks specifics on affected product/version, root cause, or remediation. Monitor for updates from Huawei advisories and the CVE record.