CVE-2026-0766

CVE-2026-0766: Ejecución Remota de Código en OpenWebUI Repositorio Educativo de Investigación en Seguridad Este repositorio contiene código de explotación de prueba de concepto para CVE-2026-0766 , una vulnerabilidad de ejecución remota de código en OpenWebUI descubierta y publicada por la Zero D...

PT-2026-60120

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow origins= and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests...

Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

PYSEC-2026-1731 Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

Exploit for Code Injection in Openwebui Open_Webui

CVE-2026-0766: OpenWebUI Remote Code Execution Educational...

hubzoid (>=0.2.2, <=0.9.3), openwebui-token-tracking (>=0.1.7, <=0.1.10) +1 more potentially affected by CVE-2025-63391 via open-webui (>=0.6.0, <=0.11.3)

open-webui PYPI version =0.6.0, =0.2.2, =0.1.7, =0.1.0, =0.1.5 Source cves: CVE-2025-63391 Source advisory: SNYK:PYTHON-OPENWEBUI-14535452...

EUVD-2025-6918

Malicious code in bioql PyPI...

CVE-2024-8060

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

CVE-2024-8060

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-8060

...

CVE-2024-8060 Remote Code Execution in OpenWebUI via Arbitrary File Upload

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability...

CVE-2024-8060

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload . The root cause is insufficient validation of the file.content_type and the acceptance of user-controlled filenames, which leads to a path traversal vulne...

PT-2025-12214

Name of the Vulnerable Software and Affected Versions OpenWebUI version 0.3.0 Description The issue concerns a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. This is due to insufficient validation on the file.content type and the...