khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Summary The /home/filepath:path endpoint in webclient.py serves static files by directly concatenating the user-supplied filepath with the homedirectory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences t...