CVE-2025-50735

By 2/11/2025, which is the release date of this CVE, the developer still haven't fix the vulnearbility nor reply my message. Same as CVE-2025-50733 XSS vulnerability.

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints.

PoC: https://hackmd.io/@fai1424/S1QvgAo0gl