Skip to content
OpenAdvisories

Package · PyPI

khoj

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High —
    GHSA-62mm-xwmv-crhg

    khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

    ### Summary The `/home/{file_path:path}` endpoint in `web_client.py` serves static files by directly concatenating the user-supplied `file_path` with the `home_directory` constant. There is no path traversal filtering, no path normalization check, and no auth…

    khoj PyPI