GHSA-vvxm-vxmr-624h: Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Summary

An unsanitised filename field in the Open WebUI speech-to-text endpoint `POST /api/v1/audio/transcriptions` lets any authenticated non-admin user trigger a `FileNotFoundError`. The error message, including the server's absolute `DATA_DIR` path, is returned verbatim in the HTTP 400 response body. The source says this confirms information disclosure on all default deployments.

Mitigation

Recommended fix in the source: in `backend/open_webui/routers/audio.py`, sanitise the extension with `Path(file.filename).name` and `Path(safe_name).suffix.lstrip(".") or "bin"` at line 1197, and at line 1231 replace the error detail with a generic message ("Transcription failed.") instead of the exception text.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News