4343 matches found
Chromium: CVE-2026-17888 Insufficient validation of untrusted input in WebUI
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
CVE-2026-17888
An insufficient validation of untrusted input flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523720529...
SUSE CVE-2026-17888
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Medium...
DEBIAN-CVE-2026-17888
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Medium...
CVE-2026-17888
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Medium...
CVE-2026-17888
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Medium...
CVE-2026-17888
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Medium...
CVE-2026-17888: Improper Input Validation
Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Medium...
CVE-2026-13893
An insufficient validation of untrusted input flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501729582...
CVE-2026-44387
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-44387: Improper Neutralization of Input During Web Page Generation
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-59764: Improper Neutralization of Special Elements used in an OS Command
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...
CVE-2026-59212
creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-2xwm-4h2q-ggfx...
GHSA-FRVJ-C5QP-XJ4W open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
AI assistance was used to help inspect the code and prepare this report. Summary The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/openwebui/routers/terminals.py documents sanitizeproxypath as decoding until stable, but the implementation stops after 8 unquote...
Server-side Request Forgery (SSRF)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the sanitizeproxypath process. An attacker can access unauthorized files or directories by submitting a specially crafted, deeply percent-encoded path parameter that bypass...
Open WebUI: Arena task endpoints can bypass underlying model access controls
Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...
GHSA-M3QF-58WF-W979 Open WebUI: Arena task endpoints can bypass underlying model access controls
Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the meta.knowledge process. An attacker can gain unauthorized write or delete access to files belonging to other users by attaching a file ID, for which they only have read...
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Summary Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds...
