Tulgaaaaaaaa

**Name of the Vulnerable Software and Affected Versions** Open WebUI versions prior to 0.9.6 **Description** The terminal-server reverse proxy in `backend/open webui/routers/terminals.py` fails to properly confine the user-controlled `path` segment before forwarding it to an admin-configured terminal server. An authenticated user with terminal server access can use encoded `../` traversal sequences to escape the intended path or policy scope, allowing access to unintended files and endpoints on the terminal-server host. If the terminal server forwards requests to internal services, this can lead to Server-Side Request Forgery (SSRF), where the server is induced to make requests to internal resources. Two vectors were identified: raw path forwarding using single-encoded traversal and a bypass of the ` sanitize proxy path` function using double-encoded dots (`%252e%252e`). **Recommendations** Update to version 0.9.6. As a temporary workaround, restrict access to the terminal server proxy functionality for non-admin users until the update is applied.

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 0.301.3 **Description** NocoDB is software for building databases as spreadsheets. The password forgot endpoint returns different responses for registered and unregistered emails, allowing user enumeration. The `/forgot-password` API endpoint is affected. The `email` parameter is used in the request. **Recommendations** Update to version 0.301.3 or later.

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 0.301.3 **Description** NocoDB is software for building databases as spreadsheets. Shared view passwords were stored in plaintext in the database and compared using direct string equality. This could allow unauthorized access to shared views. **Recommendations** Update to version 0.301.3 or later.