-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the pattern file_path = f"{UPLOAD_DIR}/{file.filename}" as the root cause. This code pattern would typically exist in the request handler function for the /models/upload endpoint. While exact function names and file paths aren't provided in the advisory, the described vulnerability pattern clearly indicates the file upload handling function associated with this endpoint is vulnerable due to: 1) Direct use of user-controlled filename without sanitization 2) Lack of path normalization 3) Absence of checks preventing directory traversal. The confidence is high because the code snippet provided in the advisory directly maps to common web framework file upload handler implementations.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip |
Ongoing coverage of React2Shell