PT-2025-12180

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A Stored Cross-Site Scripting XSS issue exists in the chat file upload functionality. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or share...

PT-2025-12211

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.10 Description The api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This issue can be exploited by sending a POST request wit...

Open WebUI 资源管理错误漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A resource management error vulnerability exists in Open WebUI version v0.3.8, which stems from the use of an overly large name field during registration by an unauthorized user, which may caus...

PT-2025-12175

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The issue allows an attacker to perform Cross-Site Request Forgery CSRF attacks. This can happen when an unaware user visits a malicious site or through top-level navigation, causing them to...

PT-2025-12138

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32 Description The absence of authentication mechanisms in open-webui/open-webui allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request...

PT-2025-12179

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The issue allows attackers to view and delete any files due to improper access control. The application fails to verify whether the attacker is an administrator, enabling them to directly call th...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version 0.3.8, which stems from an improperly handled file path in the downloadmodel endpoint, which could lead to arbitrary file writes...

PT-2025-12177

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The application exhibits improper privilege management. An attacker with administrator privileges can delete other administrators by directly accessing the API endpoint...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8, which stems from a mismanagement of permissions that allows an administrator to delete other administrators via the API...

PT-2025-12174

Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8 Description The issue arises from the improper handling of user-supplied filenames in the /models/upload endpoint, specifically due to the usage of file path = f"UPLOAD DIR/file.filename" without proper input validatio...

PT-2025-12080 · Unknown · Automatic1111/Stable-Diffusion-Webui

Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: The software is susceptible to a flaw where the server does not properly manage extra characters added to the end of multipart boundaries. This can be exploited by sending...

PT-2025-12097 · Unknown · Automatic1111/Stable-Diffusion-Webui

Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: A Cross-Site WebSocket Hijacking CSWSH vulnerability allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability is due to a lack of...

编号撤回

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...

Open WebUI 资源管理错误漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A resource management error vulnerability exists in Open WebUI version 0.3.32, which stems from an unvalidated character length and could lead to a denial of service attack...

Open WebUI 代码问题漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A code issue vulnerability exists in Open WebUI version 0.3.8, which stems from server-side request forgery and could lead to internal services being accessed...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8 that stems from improper access control and allows an attacker to view and delete arbitrary files...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. A security vulnerability exists in Open WebUI version v10, which stems from improper path cleanup and could lead to unauthorized directory access...

PT-2025-12195

Name of the Vulnerable Software and Affected Versions open-webui/open-webui versions = 0.3.8 Description A vulnerability allows remote code execution by non-admin users via Cross-Site Request Forgery CSRF. The application uses cookies with the SameSite attribute set to lax for authentication and...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. A security vulnerability exists in Open WebUI version 0.3.8, which stems from a session fixation attack that could lead to an administrator account takeover...

编号撤回

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...