PYSEC-2026-2713 Open WebUI allows limited stored XSS vila uploaded html file

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

CVE-2026-40384: Improper Limitation of a Pathname to a Restricted Directory

An improper validation of the search parameter of the commedia files API endpoint leads to a path traversal vulnerability...