https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:57:22.052533+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-28786 CVE-2026-28786 — Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions` 2026-10-07T21:57:22.067946+00:00

Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a `FileNotFoundError` whose message — including the server's absolute `DATA_DIR` path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments. Version 0.8.6 patches the issue.