Sermikr0

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** The terminal-server reverse proxy in `backend/open webui/routers/terminals.py` fails to properly confine the user-controlled `path` segment before forwarding it to an admin-configured terminal server. An authenticated user with terminal server access can use encoded `../` traversal sequences to escape the intended path or policy scope, allowing access to unintended files and endpoints on the terminal-server host. If the terminal server forwards requests to internal services, this can lead to Server-Side Request Forgery (SSRF), where the server is induced to make requests to internal resources. Two vectors were identified: raw path forwarding using single-encoded traversal and a bypass of the ` sanitize proxy path` function using double-encoded dots (`%252e%252e`). **Recommendations** Update to version 0.9.6. As a temporary workaround, restrict access to the terminal server proxy functionality for non-admin users until the update is applied.

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the tasmota/tasmota xdrv driver/xdrv 10 scripter.ino, fetch jpg() function.

Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv 10 scripter.ino, fetch jpg(), jpg task.boundary[40], strcpy() function.

An issue in fetch jpg() in xdrv 10 scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow. The Content-Length from a JPEG stream is stored in a uint16 t variable; values above 65535 wrap around, causing allocation of a smaller buffer than the data actually read.