Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Summary A user granted write access to a shared chat folder could permanently delete chats and messages belonging to the folder's owner. Deleting a folder cascades into the owner's chats and the entire subfolder subtree, and the deletion handler required only write access on subfolders instead of...

PT-2026-54441

Name of the Vulnerable Software and Affected Versions CefSharp versions prior to 148.0.90 Description CefSharp provides .NET bindings for the Chromium Embedded Framework. The FolderSchemeHandlerFactory class fails to properly enforce directory boundaries when validating if a decoded and...