PT-2025-26240 · Upsonic · Upsonic

Name of the Vulnerable Software and Affected Versions: Upsonic versions up to 0.55.6 Description: A critical vulnerability was found in Upsonic, affecting the function os.path.join of the file markdown/server.py. The manipulation of the argument file.filename leads to path traversal. The exploit...

CVE-2024-7037

CVE-2024-7037 has multiple connected advisories confirming a vulnerability in open-webui v0.3.8. The issue is in the endpoint /api/pipelines/upload, where unsanitized file.filename is concatenated with CACHE_DIR, enabling arbitrary file write and delete operations. This can allow overwriting or d...