Avrlab233

**اسم البرنامج المصاب والإصدارات المتأثرة** Open WebUI الإصدارات من 0.11.0 إلى 0.11.3 **Description** توجد مشكلة في التصريح غير المناسب في معالج تفرع الدردشة (chat fork handler). يقوم النظام بوضع الدردشات المتفرعة في مجلد الدردشة المصدر دون التحقق مما إذا كان المستخدم يملك صلاحية الكتابة في ذلك المجلد. يتيح ذلك لأعضاء المجلد المشترك الذين تم تخفيض صلاحياتهم إلى القراءة فقط استخدام نقطة النهاية 'POST /api/v1/chats/{id}/fork' على الدردشات التي أنشؤوها سابقاً، مما يسمح لهم بإدراج دردشات يتحكم بها المهاجم وتكون مرئية لمالك المجلد والأعضاء الآخرين. **Recommendations** تحديث Open WebUI إلى الإصدار 0.11.4 أو إصدار أحدث.

**Name of the Vulnerable Software and Affected Versions** Handlebars.java versions prior to 4.5.5 **Description** An issue allows directory traversal when using a Spring MVC application with a `file:` template prefix and a request-derived view name. In certain versions, template locations are validated as raw percent-encoded strings, but the template file is opened via a URL handler that percent-decodes the path. This allows a percent-encoded traversal sequence, such as `%2e%2e/`, to bypass the view-resolver check and the loader-side containment, enabling the reading of files outside the configured template base directory. **Recommendations** Update Handlebars.java to version 4.5.5 or later.

**Name of the Vulnerable Software and Affected Versions** vulnerability-lookup (affected versions not specified) **Description** The account recovery functionality contains a time-of-check-to-time-of-use (TOCTOU) race condition—a scenario where a system checks a condition and then uses the result, but the condition changes between the check and the use—during the consumption of single-use recovery tokens. This occurs because the system verifies the token nonce and clears it in separate database operations. Consequently, two concurrent HTTP requests using the same valid token can both pass verification, allowing an attacker with a valid token to overwrite a legitimate user's password. Additionally, the `/user/confirm account/<token>` endpoint allows setting empty or trivially short passwords because the view handler performs a manual equality comparison between password fields without invoking the form's validation logic, bypassing complexity and length constraints. The issue resides in the `User` model (`website/models/user.py`) and the view layer (`website/web/views/user.py`). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.