PYSEC-2026-2748 Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

Summary The audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHEDIR/audio/transcriptions/.. The /cache/path route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no...

PT-2025-26732

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue arises when a user saves a response from the Network tab in Devtools using the Save As context menu option. In this scenario, the saved file may not have the .download file extension,...

PT-2024-28001 · Unknown · Matrix Tafnit

Name of the Vulnerable Software and Affected Versions: Matrix Tafnit version 8 Description: The issue is related to reliance on the file name or extension of externally-supplied files, as indicated by CWE-646. Recommendations: For Matrix Tafnit version 8, at the moment, there is no information...