PT-2025-12195

Name of the Vulnerable Software and Affected Versions open-webui/open-webui versions = 0.3.8 Description A vulnerability allows remote code execution by non-admin users via Cross-Site Request Forgery CSRF. The application uses cookies with the SameSite attribute set to lax for authentication and...

PT-2025-12137

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32 Description The application lacks character length validation on the email and password fields during the sign-in process. This allows users to submit large payloads, potentially leading to a Denial of...

Open WebUI 资源管理错误漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A resource management error vulnerability exists in Open WebUI version 0.3.32, which stems from an unvalidated character length and could lead to a denial of service attack...

PT-2025-12178 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: The issue is related to improper access control. Administrators are supposed to view only the chats of non-admin members on the frontend admin page. However, it is possible to view the chats o...

Open WebUI 跨站请求伪造漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site request forgery vulnerability exists in Open WebUI version v0.3.8, which stems from the use of the GET method for sensitive operations and could lead to a cross-site request forger...

PT-2025-12177

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The application exhibits improper privilege management. An attacker with administrator privileges can delete other administrators by directly accessing the API endpoint...

PT-2025-12150

Name of the Vulnerable Software and Affected Versions open-webui version 0.3.32 fastapi versions prior to 0.115.3 Description The issue arises from the application's use of a vulnerable version of the starlette package, which is a dependency of fastapi. This vulnerability can lead to uncontrolled...

PT-2025-12174

Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8 Description The issue arises from the improper handling of user-supplied filenames in the /models/upload endpoint, specifically due to the usage of file path = f"UPLOAD DIR/file.filename" without proper input validatio...

PT-2025-12211

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.10 Description The api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This issue can be exploited by sending a POST request wit...

PT-2025-12176

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A vulnerability allows an unauthenticated attacker to sign up with excessively large text in the name field, causing the Admin panel to become unresponsive. This prevents administrators from...

PT-2025-12180

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A Stored Cross-Site Scripting XSS issue exists in the chat file upload functionality. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or share...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in Open WebUI version 0.3.8 that originates from allowing arbitrary code execution...

CVE-2024-7044: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting XSS vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. Th...

PT-2025-12179

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The issue allows attackers to view and delete any files due to improper access control. The application fails to verify whether the attacker is an administrator, enabling them to directly call th...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8 that stems from improper access control and allows an attacker to view administrator details...

Open WebUI 资源管理错误漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A resource management error vulnerability exists in Open WebUI version v0.3.8, which stems from the use of an overly large name field during registration by an unauthorized user, which may caus...

CVE-2024-7043: Missing Authorization

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. A security vulnerability exists in Open WebUI version 0.3.8, which stems from a session fixation attack that could lead to an administrator account takeover...

PT-2025-12183

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A vulnerability allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secu...

PT-2026-41177

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.5.11 Description A blind server side request forgery SSRF exists in the PDF generate function. User inputs are interpreted as HTML and embedded into the PDF. While scripts and certain dangerous tags like iFrame a...