CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 未认证路径遍历 → 任意文件写入 CVSS 9.8（严重） · CWE-22 · GHSA/Issue 3104 概述 DB-GPT v0.8.1 中的 POST /api/v1/python/file/upload 接口接收 user-id HTTP 头，并将其 原样用作路径组件 ： root@kitploit: uploaddir = os.path.joinbasedir, "pythonuploads", userid os.makedirsuploaddir, existok=True openfilepath,...

CVE-2026-16637 OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

EUVD-2026-54479

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

CVE-2026-59224

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...

CVE-2026-59224 Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/openwebui/routers/terminals.py built the wsterminal upstream URL from an unencoded sessionid and appended userid as a query parameter, allowing query injection to make the terminal backe...