172 matches found
CVE-2024-12534 Denial of Service (DoS) in open-webui/open-webui
In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs. This vulnerability can lead to a Denial of Service DoS condition when a us...
CVE-2024-12534 Denial of Service (DoS) in open-webui/open-webui
In version v0.3.32 of open-webui/open-webui, the application allows users to submit large payloads in the email and password fields during the sign-in process due to the lack of character length validation on these inputs. This vulnerability can lead to a Denial of Service DoS condition when a us...
CVE-2024-7034
...
CVE-2024-7034
Open WebUI open-webui has a documented vulnerability in version 0.3.8 where the /models/upload endpoint writes files arbitrarily due to using file_path = f"{UPLOAD_DIR}/{file.filename}" without input validation. This allows directory traversal via crafted file.filename to escape UPLOAD_DIR and ov...
CVE-2024-7034 Remote Code Execution due to Arbitrary File Write in open-webui/open-webui
In open-webui version 0.3.8, the endpoint /models/upload is vulnerable to arbitrary file write due to improper handling of user-supplied filenames. The vulnerability arises from the usage of filepath = f"UPLOADDIR/file.filename" without proper input validation or sanitization. An attacker can...
CVE-2024-7043 Improper Access Control in open-webui/open-webui
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...
CVE-2024-7983 Denial of Service in open-webui/open-webui
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until...
CVE-2024-7983 Denial of Service in open-webui/open-webui
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until...
CVE-2024-7044 Stored XSS in open-webui/open-webui
A Stored Cross-Site Scripting XSS vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. Th...
CVE-2024-12868
CVE-2024-12868 is rejected and should not be used; reference CVE-2024-47874.
CVE-2024-7045 Improper Access Control in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt...
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-7035
The CVE-2024-7035 issue affects open-webui/open-webui (v0.3.8). The underlying problem is CSRF because sensitive actions (delete/reset) are invoked via GET requests. Affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads, impactin...
CVE-2024-12537 Unauthenticated Denial of Service in open-webui/open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...
CVE-2024-7959 SSRF in open-webui/open-webui
The /openai/models endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery SSRF. An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the...
CVE-2024-7990 Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting XSS vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious...
Open WebUI 跨站请求伪造漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site request forgery vulnerability exists in Open WebUI version v0.3.8, which stems from the use of the GET method for sensitive operations and could lead to a cross-site request forger...
PT-2025-12137
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32 Description The application lacks character length validation on the email and password fields during the sign-in process. This allows users to submit large payloads, potentially leading to a Denial of...