From 7964a413c1b1a2f43d3cfa3fd3e6064b31d7b4f8 Mon Sep 17 00:00:00 2001
From: Elwood Ying <nyale1024@gmail.com>
Date: Fri, 3 Jul 2026 16:30:27 +0800
Subject: [PATCH 1/3] Add CVE rules for Jan and Open WebUI components

Add 4 NVD-verified CVE rules for components that had fingerprints
but no vulnerability rules:

- Jan CVE-2024-36858: Arbitrary file upload via /v1/app/writeFileSync
  (CVSS 9.8, CRITICAL) - NVD confirmed, GHSA-qfjh-mvq6-c5p8

- Open WebUI CVE-2025-46719: Stored XSS via HTML tags in chat messages
  (CVSS 5.4, MEDIUM) - NVD confirmed, GHSA-9f4f-jv96-8766

- Open WebUI CVE-2026-45346: Stored XSS in SVG renderer
  (CVSS 5.4, MEDIUM) - NVD confirmed, GHSA-r29h-37fj-x2w6

- Open WebUI CVE-2026-54014: Path traversal in cache file serving
  (CVSS 4.3, MEDIUM) - NVD confirmed, GHSA-j2c8-v969-8r5c

All CVEs verified via NVD API (services.nvd.nist.gov) with exact
CVE IDs, descriptions, CVSS scores, and reference URLs.
---
 data/vuln/jan/CVE-2024-36858.yaml        | 22 +++++++++++++++++++++
 data/vuln/open-webui/CVE-2025-46719.yaml | 25 ++++++++++++++++++++++++
 data/vuln/open-webui/CVE-2026-45346.yaml | 20 +++++++++++++++++++
 data/vuln/open-webui/CVE-2026-54014.yaml | 22 +++++++++++++++++++++
 4 files changed, 89 insertions(+)
 create mode 100644 data/vuln/jan/CVE-2024-36858.yaml
 create mode 100644 data/vuln/open-webui/CVE-2025-46719.yaml
 create mode 100644 data/vuln/open-webui/CVE-2026-45346.yaml
 create mode 100644 data/vuln/open-webui/CVE-2026-54014.yaml

diff --git a/data/vuln/jan/CVE-2024-36858.yaml b/data/vuln/jan/CVE-2024-36858.yaml
new file mode 100644
index 000000000..5afd4eed8
--- /dev/null
+++ b/data/vuln/jan/CVE-2024-36858.yaml
@@ -0,0 +1,22 @@
+info:
+  name: jan
+  cve: CVE-2024-36858
+  summary: Jan 存在任意文件上传漏洞，攻击者可通过 /v1/app/writeFileSync 接口执行任意代码。
+  details: |
+    Jan v0.4.12 的 /v1/app/writeFileSync 接口存在任意文件上传漏洞。
+    攻击者可以通过该接口上传恶意构造的文件，从而在目标服务器上执行任意代码。
+    该漏洞源于接口对文件路径和内容缺乏充分的安全校验，允许攻击者覆盖关键系统文件或写入恶意脚本。
+    该漏洞已在 janhq/jan v0.5.2 中修复（原 @janhq/core 包已废弃）。
+  cvss: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+  severity: CRITICAL
+  security_advise: |
+    1. 将 Jan 升级到 `0.5.2` 或更高版本。
+    2. 限制 /v1/app/writeFileSync 接口的访问权限，仅允许可信来源调用。
+    3. 对文件写入路径进行严格的白名单校验，禁止写入系统关键目录。
+    4. 部署 WAF 规则检测和拦截恶意文件上传请求。
+rule: version > "0" && version < "0.5.2"
+references:
+  - https://github.com/advisories/GHSA-qfjh-mvq6-c5p8
+  - https://nvd.nist.gov/vuln/detail/CVE-2024-36858
+  - https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability
+  - https://github.com/janhq/jan
diff --git a/data/vuln/open-webui/CVE-2025-46719.yaml b/data/vuln/open-webui/CVE-2025-46719.yaml
new file mode 100644
index 000000000..93494653b
--- /dev/null
+++ b/data/vuln/open-webui/CVE-2025-46719.yaml
@@ -0,0 +1,25 @@
+info:
+  name: openwebui
+  cve: CVE-2025-46719
+  summary: Open WebUI 存在存储型 XSS 漏洞，通过聊天消息中的 HTML 标签注入 JavaScript 代码。
+  details: |
+    Open WebUI 在 0.6.6 之前版本中，聊天消息渲染时对某些 HTML 标签处理不当，
+    攻击者可在聊天记录中注入 JavaScript 代码。该代码在用户每次打开该聊天记录时执行，
+    可窃取用户访问令牌并完全控制其账户。聊天记录可在同一服务器用户间共享，
+    若管理员启用了"Community Sharing"则可向整个社区传播。
+    若针对管理员用户利用此漏洞，可通过创建包含恶意 Python 代码的函数实现远程代码执行。
+    该漏洞还影响 openwebui.com 上的共享聊天记录，形成可蠕虫式传播的存储型 XSS。
+    该漏洞在 0.6.6 版本中修复。
+  cvss: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+  severity: MEDIUM
+  security_advise: |
+    1. 将 Open-WebUI 升级到 `0.6.6` 或更高版本。
+    2. 在管理员面板中禁用 "Enable Community Sharing" 功能，减少攻击面。
+    3. 对聊天消息中的 HTML 内容进行严格的输入清理，使用 DOMPurify 等库过滤危险标签。
+    4. 限制函数创建功能的权限，仅允许受信任的管理员创建自定义函数。
+rule: version > "0" && version < "0.6.6"
+references:
+  - https://github.com/open-webui/open-webui/security/advisories/GHSA-9f4f-jv96-8766
+  - https://nvd.nist.gov/vuln/detail/CVE-2025-46719
+  - https://github.com/open-webui/open-webui/commit/6fd082d55ffaf6eb226efdeebc7155e3693d2d01
+  - https://github.com/open-webui/open-webui
diff --git a/data/vuln/open-webui/CVE-2026-45346.yaml b/data/vuln/open-webui/CVE-2026-45346.yaml
new file mode 100644
index 000000000..9315176d6
--- /dev/null
+++ b/data/vuln/open-webui/CVE-2026-45346.yaml
@@ -0,0 +1,20 @@
+info:
+  name: openwebui
+  cve: CVE-2026-45346
+  summary: Open WebUI 的 SVG 渲染器存在存储型跨站脚本漏洞。
+  details: |
+    Open WebUI 在 0.6.31 之前版本中，SVG 渲染器实现存在跨站脚本漏洞。
+    攻击者可通过构造恶意 SVG 内容注入 JavaScript 代码，在用户浏览器中执行。
+    该漏洞可导致用户会话令牌窃取和账户接管。
+    该漏洞在 0.6.31 版本中修复。
+  cvss: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+  severity: MEDIUM
+  security_advise: |
+    1. 将 Open-WebUI 升级到 `0.6.31` 或更高版本。
+    2. 对 SVG 内容进行严格清理，移除其中的 <script> 标签和事件处理器属性。
+    3. 使用 CSP（Content Security Policy）限制内联脚本执行。
+rule: version > "0" && version < "0.6.31"
+references:
+  - https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6
+  - https://nvd.nist.gov/vuln/detail/CVE-2026-45346
+  - https://github.com/open-webui/open-webui
diff --git a/data/vuln/open-webui/CVE-2026-54014.yaml b/data/vuln/open-webui/CVE-2026-54014.yaml
new file mode 100644
index 000000000..d2fdb41f7
--- /dev/null
+++ b/data/vuln/open-webui/CVE-2026-54014.yaml
@@ -0,0 +1,22 @@
+info:
+  name: openwebui
+  cve: CVE-2026-54014
+  summary: Open WebUI 缓存文件服务端点存在路径遍历漏洞，允许认证用户读取缓存目录之外的文件。
+  details: |
+    Open WebUI 在 0.9.6 之前版本中，缓存文件服务端点 serve_cache_file() 存在路径遍历漏洞。
+    该函数使用 file_path.startswith(os.path.abspath(CACHE_DIR)) 验证路径，
+    但未追加 os.sep 作为路径分隔符，导致任何解析为以 "cache" 开头的同级目录
+    （如 cache_sibling、cache_backup、cached_models）的路径均可通过验证。
+    已认证用户可利用此漏洞读取缓存目录同级目录中的任意文件。
+    该漏洞在 0.9.6 版本中修复。
+  cvss: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
+  severity: MEDIUM
+  security_advise: |
+    1. 将 Open-WebUI 升级到 `0.9.6` 或更高版本。
+    2. 对文件路径验证使用严格的规范化比较，确保路径在目标目录之内。
+    3. 限制缓存文件服务端点的访问权限，仅允许必要的服务内部调用。
+rule: version > "0" && version < "0.9.6"
+references:
+  - https://github.com/open-webui/open-webui/security/advisories/GHSA-j2c8-v969-8r5c
+  - https://nvd.nist.gov/vuln/detail/CVE-2026-54014
+  - https://github.com/open-webui/open-webui

From a7350d90a94a601104cd85c64917121bd8bf749c Mon Sep 17 00:00:00 2001
From: Elwood Ying <nyale1024@gmail.com>
Date: Fri, 3 Jul 2026 16:35:17 +0800
Subject: [PATCH 2/3] Add English versions of CVE rules for Jan and Open WebUI

Add English translations (data/vuln_en/) for the 4 CVE rules
previously added in data/vuln/:

- Jan CVE-2024-36858 (en)
- Open WebUI CVE-2025-46719 (en)
- Open WebUI CVE-2026-45346 (en)
- Open WebUI CVE-2026-54014 (en)

Maintains the project's bilingual (Chinese/English) convention
for vulnerability rules.
---
 data/vuln_en/jan/CVE-2024-36858.yaml        | 23 ++++++++++++++++++
 data/vuln_en/open-webui/CVE-2025-46719.yaml | 26 +++++++++++++++++++++
 data/vuln_en/open-webui/CVE-2026-45346.yaml | 20 ++++++++++++++++
 data/vuln_en/open-webui/CVE-2026-54014.yaml | 23 ++++++++++++++++++
 4 files changed, 92 insertions(+)
 create mode 100644 data/vuln_en/jan/CVE-2024-36858.yaml
 create mode 100644 data/vuln_en/open-webui/CVE-2025-46719.yaml
 create mode 100644 data/vuln_en/open-webui/CVE-2026-45346.yaml
 create mode 100644 data/vuln_en/open-webui/CVE-2026-54014.yaml

diff --git a/data/vuln_en/jan/CVE-2024-36858.yaml b/data/vuln_en/jan/CVE-2024-36858.yaml
new file mode 100644
index 000000000..090de3b5b
--- /dev/null
+++ b/data/vuln_en/jan/CVE-2024-36858.yaml
@@ -0,0 +1,23 @@
+info:
+  name: jan
+  cve: CVE-2024-36858
+  summary: Jan is vulnerable to arbitrary file upload via the /v1/app/writeFileSync endpoint, enabling remote code execution.
+  details: |
+    Jan v0.4.12 has an arbitrary file upload vulnerability in the /v1/app/writeFileSync endpoint.
+    Attackers can upload maliciously crafted files through this endpoint, allowing arbitrary code execution
+    on the target server. The vulnerability stems from insufficient validation of file paths and content,
+    enabling attackers to overwrite critical system files or write malicious scripts.
+    This vulnerability was fixed in janhq/jan v0.5.2 (the original @janhq/core package was deprecated).
+  cvss: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+  severity: CRITICAL
+  security_advise: |
+    1. Upgrade Jan to version `0.5.2` or later.
+    2. Restrict access to the /v1/app/writeFileSync endpoint, allowing only trusted sources.
+    3. Apply strict whitelist validation for file write paths, prohibiting writes to critical system directories.
+    4. Deploy WAF rules to detect and block malicious file upload requests.
+rule: version > "0" && version < "0.5.2"
+references:
+  - https://github.com/advisories/GHSA-qfjh-mvq6-c5p8
+  - https://nvd.nist.gov/vuln/detail/CVE-2024-36858
+  - https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability
+  - https://github.com/janhq/jan
diff --git a/data/vuln_en/open-webui/CVE-2025-46719.yaml b/data/vuln_en/open-webui/CVE-2025-46719.yaml
new file mode 100644
index 000000000..efedfc671
--- /dev/null
+++ b/data/vuln_en/open-webui/CVE-2025-46719.yaml
@@ -0,0 +1,26 @@
+info:
+  name: openwebui
+  cve: CVE-2025-46719
+  summary: Open WebUI is vulnerable to stored XSS via HTML tags in chat messages, enabling session token theft and potential RCE.
+  details: |
+    Open WebUI prior to version 0.6.6 improperly handles certain HTML tags during chat message rendering,
+    allowing attackers to inject JavaScript code into chat records. This code executes every time a user
+    opens the affected chat record, enabling session token theft and full account takeover. Chat records
+    can be shared among users on the same server, and if an administrator has enabled "Community Sharing,"
+    the payload can spread to the entire community. When exploited against an administrator, this
+    vulnerability can lead to remote code execution via creation of functions containing malicious Python
+    code. The vulnerability also affects shared chat records on openwebui.com, enabling worm-like
+    propagation of the stored XSS. This was fixed in version 0.6.6.
+  cvss: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+  severity: MEDIUM
+  security_advise: |
+    1. Upgrade Open-WebUI to version `0.6.6` or later.
+    2. Disable the "Enable Community Sharing" feature in the admin panel to reduce the attack surface.
+    3. Apply strict input sanitization on HTML content in chat messages using libraries such as DOMPurify to filter dangerous tags.
+    4. Restrict function creation permissions to trusted administrators only.
+rule: version > "0" && version < "0.6.6"
+references:
+  - https://github.com/open-webui/open-webui/security/advisories/GHSA-9f4f-jv96-8766
+  - https://nvd.nist.gov/vuln/detail/CVE-2025-46719
+  - https://github.com/open-webui/open-webui/commit/6fd082d55ffaf6eb226efdeebc7155e3693d2d01
+  - https://github.com/open-webui/open-webui
diff --git a/data/vuln_en/open-webui/CVE-2026-45346.yaml b/data/vuln_en/open-webui/CVE-2026-45346.yaml
new file mode 100644
index 000000000..52660b913
--- /dev/null
+++ b/data/vuln_en/open-webui/CVE-2026-45346.yaml
@@ -0,0 +1,20 @@
+info:
+  name: openwebui
+  cve: CVE-2026-45346
+  summary: Open WebUI SVG renderer is vulnerable to stored cross-site scripting.
+  details: |
+    Open WebUI prior to version 0.6.31 has a cross-site scripting vulnerability in its SVG renderer
+    implementation. Attackers can inject JavaScript code by crafting malicious SVG content, which
+    executes in the victim's browser. This can lead to session token theft and account takeover.
+    This was fixed in version 0.6.31.
+  cvss: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+  severity: MEDIUM
+  security_advise: |
+    1. Upgrade Open-WebUI to version `0.6.31` or later.
+    2. Sanitize SVG content strictly, removing <script> tags and event handler attributes.
+    3. Use CSP (Content Security Policy) to restrict inline script execution.
+rule: version > "0" && version < "0.6.31"
+references:
+  - https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6
+  - https://nvd.nist.gov/vuln/detail/CVE-2026-45346
+  - https://github.com/open-webui/open-webui
diff --git a/data/vuln_en/open-webui/CVE-2026-54014.yaml b/data/vuln_en/open-webui/CVE-2026-54014.yaml
new file mode 100644
index 000000000..8a949fb0a
--- /dev/null
+++ b/data/vuln_en/open-webui/CVE-2026-54014.yaml
@@ -0,0 +1,23 @@
+info:
+  name: openwebui
+  cve: CVE-2026-54014
+  summary: Open WebUI cache file serving endpoint is vulnerable to path traversal, allowing authenticated users to read files outside the cache directory.
+  details: |
+    Open WebUI prior to version 0.9.6 has a path traversal vulnerability in the cache file serving
+    endpoint serve_cache_file(). The function validates paths using
+    file_path.startswith(os.path.abspath(CACHE_DIR)) without appending os.sep as a path separator,
+    allowing any path that resolves to a sibling directory starting with "cache" (such as
+    cache_sibling, cache_backup, cached_models) to pass validation. Authenticated users can exploit
+    this to read arbitrary files in sibling directories of the cache directory.
+    This was fixed in version 0.9.6.
+  cvss: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
+  severity: MEDIUM
+  security_advise: |
+    1. Upgrade Open-WebUI to version `0.9.6` or later.
+    2. Use strict canonicalization-based path comparison to ensure paths remain within the target directory.
+    3. Restrict access to the cache file serving endpoint, allowing only necessary internal service calls.
+rule: version > "0" && version < "0.9.6"
+references:
+  - https://github.com/open-webui/open-webui/security/advisories/GHSA-j2c8-v969-8r5c
+  - https://nvd.nist.gov/vuln/detail/CVE-2026-54014
+  - https://github.com/open-webui/open-webui

From 6e68c2ff0ddad8bf50d4786f07718ea3ce6259b2 Mon Sep 17 00:00:00 2001
From: Elwood Ying <nyale1024@gmail.com>
Date: Mon, 6 Jul 2026 10:40:50 +0800
Subject: [PATCH 3/3] Remove Jan CVE-2024-36858 to avoid duplicate with PR #457

Per code review feedback, removing Jan CVE rules from this PR.
PR #457 (add-cve-rules-for-jan-localai) will handle Jan CVEs instead.
This avoids merge conflicts between the two PRs.
---
 data/vuln/jan/CVE-2024-36858.yaml    | 22 ----------------------
 data/vuln_en/jan/CVE-2024-36858.yaml | 23 -----------------------
 2 files changed, 45 deletions(-)
 delete mode 100644 data/vuln/jan/CVE-2024-36858.yaml
 delete mode 100644 data/vuln_en/jan/CVE-2024-36858.yaml

diff --git a/data/vuln/jan/CVE-2024-36858.yaml b/data/vuln/jan/CVE-2024-36858.yaml
deleted file mode 100644
index 5afd4eed8..000000000
--- a/data/vuln/jan/CVE-2024-36858.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-info:
-  name: jan
-  cve: CVE-2024-36858
-  summary: Jan 存在任意文件上传漏洞，攻击者可通过 /v1/app/writeFileSync 接口执行任意代码。
-  details: |
-    Jan v0.4.12 的 /v1/app/writeFileSync 接口存在任意文件上传漏洞。
-    攻击者可以通过该接口上传恶意构造的文件，从而在目标服务器上执行任意代码。
-    该漏洞源于接口对文件路径和内容缺乏充分的安全校验，允许攻击者覆盖关键系统文件或写入恶意脚本。
-    该漏洞已在 janhq/jan v0.5.2 中修复（原 @janhq/core 包已废弃）。
-  cvss: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-  severity: CRITICAL
-  security_advise: |
-    1. 将 Jan 升级到 `0.5.2` 或更高版本。
-    2. 限制 /v1/app/writeFileSync 接口的访问权限，仅允许可信来源调用。
-    3. 对文件写入路径进行严格的白名单校验，禁止写入系统关键目录。
-    4. 部署 WAF 规则检测和拦截恶意文件上传请求。
-rule: version > "0" && version < "0.5.2"
-references:
-  - https://github.com/advisories/GHSA-qfjh-mvq6-c5p8
-  - https://nvd.nist.gov/vuln/detail/CVE-2024-36858
-  - https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability
-  - https://github.com/janhq/jan
diff --git a/data/vuln_en/jan/CVE-2024-36858.yaml b/data/vuln_en/jan/CVE-2024-36858.yaml
deleted file mode 100644
index 090de3b5b..000000000
--- a/data/vuln_en/jan/CVE-2024-36858.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-info:
-  name: jan
-  cve: CVE-2024-36858
-  summary: Jan is vulnerable to arbitrary file upload via the /v1/app/writeFileSync endpoint, enabling remote code execution.
-  details: |
-    Jan v0.4.12 has an arbitrary file upload vulnerability in the /v1/app/writeFileSync endpoint.
-    Attackers can upload maliciously crafted files through this endpoint, allowing arbitrary code execution
-    on the target server. The vulnerability stems from insufficient validation of file paths and content,
-    enabling attackers to overwrite critical system files or write malicious scripts.
-    This vulnerability was fixed in janhq/jan v0.5.2 (the original @janhq/core package was deprecated).
-  cvss: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
-  severity: CRITICAL
-  security_advise: |
-    1. Upgrade Jan to version `0.5.2` or later.
-    2. Restrict access to the /v1/app/writeFileSync endpoint, allowing only trusted sources.
-    3. Apply strict whitelist validation for file write paths, prohibiting writes to critical system directories.
-    4. Deploy WAF rules to detect and block malicious file upload requests.
-rule: version > "0" && version < "0.5.2"
-references:
-  - https://github.com/advisories/GHSA-qfjh-mvq6-c5p8
-  - https://nvd.nist.gov/vuln/detail/CVE-2024-36858
-  - https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability
-  - https://github.com/janhq/jan