3 matches found
PYSEC-2026-1719 Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint
In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's...
Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint
Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel...
