OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

GHSA-86CX-WWF4-PHQ4 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

Summary An authorization bypass and information disclosure vulnerability exists in the search API of Openlist. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned BasePath restrictions to discover and access metadata of files...

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...

GHSA-95CV-R8X4-VH75 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

Impact The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on...

GHSA-F45Q-W629-WR25 Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

Impact The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on...

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...

EUVD-2026-42628

Open WebUI: Upload metadata.knowledgeid bypasses the knowledge-base write-access check read-only users can add files to KB...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the processuploadedfile process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledgeid value during...

GHSA-7R7X-GJVR-448G Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...

GHSA-9XWG-3R6F-JCX2 PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

Directory Traversal

Overview pymdown-extensions is an Extension pack for Python Markdown. Affected versions of this package are vulnerable to Directory Traversal via the replpath function in the b64 extension when processing attacker-controlled paths. An attacker can disclose the contents of files outside the intend...

PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured basepath with os.path.normpath and opens the result directly, with no check that the resolved path stays inside basepath. A src containing ../ sequences, or an...

OESA-2026-3150 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

OESA-2026-3149 sssd security update

Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...

SUSE CVE-2026-63858

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFTHOOKREMOVE, but add a new transaction object to track deletion of hooks without altering the...

Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing

Ethereum non-fungible tokens NFTs implement ownership, transfer, authorization, and metadata operations through smart contracts, making contract vulnerabilities a direct risk to digital assets. Existing static analyzers provide efficient rule-based screening but can struggle with...

CVE-2026-64244: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem-altmap after successful device registration If addmemoryblock fails at xastore under memory pressure for example, deviceunregister is called, which eventually triggers memoryblockrelease with mem-altm...

PT-2026-64443

Name of the Vulnerable Software and Affected Versions pymdown-extensions version 10.21.3 Description The b64 extension inlines images referenced by as base64 data URIs. The repl path function in pymdownx/b64.py fails to verify that the resolved path remains within the configured base path. An...