open-webui vulnerabilities

CVEs whose affected-version data names the open-webui package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

open-webui vulnerabilities

Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion

Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Open WebUI: Any authenticated user can read other users' private notes via Socket.IO

Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url

Open WebUI has an Indirect Object Reference (IDOR) in user notes

Open WebUI has an IDOR vulnerability in the update_message_by_id API endpoint

Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]

Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)

Open WebUI Exposes System Prompt to Regular User [Non-Admin]

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

Open WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)

Open WebUI missing authorization check at the model update function - models from other users can be updated

Open WebUI has Broken Access Control for Completions API

Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function

Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`

Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

Open WebUI has Stored Cross-Site Scripting In Profile Picture

Open WebUI Vulnerable to Unauthenticated RAG Configuration Disclosure