fix: suppress internal path leakage in audio transcription errors (GHSA-vvxm-vxmr-624h) (open-webui#22108)

- Use os.path.basename() for filename sanitization instead of fragile blocklist

- Replace ERROR_MESSAGES.DEFAULT(e) with generic error message in both except blocks to prevent CWE-209 information disclosure

- Server-side logging via log.exception(e) is preserved for debugging

Author: Classic298

backend/open_webui/routers/audio.py

@@ -1194,8 +1194,8 @@ def transcription(
         )
 
     try:
-        ext = file.filename.split(".")[-1] if file.filename else ""
-        ext = ext.replace("/", "").replace("\\", "").replace("..", "")
+        safe_name = os.path.basename(file.filename) if file.filename else ""
+        ext = safe_name.rsplit(".", 1)[-1] if "." in safe_name else ""
 
         id = uuid.uuid4()
 
@@ -1231,15 +1231,15 @@ def transcription(
 
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=ERROR_MESSAGES.DEFAULT(e),
+                detail="Transcription failed.",
             )
 
     except Exception as e:
         log.exception(e)
 
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=ERROR_MESSAGES.DEFAULT(e),
+            detail="Transcription failed.",
         )