open-webui

PyPI61 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting open-webuipage 1 of 2

CVE-2024-6706MEDIUMCVSS 6.1EG 6.1
2024-08-07
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.
CVE-2024-7037HIGHCVSS 7.2EG 6.5
2024-10-09
vulnerable: 0.1.124 ... 0.3.8 (21 versions)
In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite…
CVE-2024-7038LOWCVSS 2.7EG 2.7
2024-10-09
vulnerable: 0.1.124 ... 0.3.8 (21 versions)
An information disclosure vulnerability exists in open-webui version 0.3.8. The vulnerability is related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists a…
CVE-2024-7041MEDIUMCVSS 6.5EG 6.5
2024-10-09
vulnerable: 0.1.124 ... 0.3.8 (17 versions)
An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is f…
CVE-2024-8060HIGHCVSS 8.1EG 8.1✓ Fixed in 0.5.17
2025-03-20
vulnerable: 0.1.124 ... 0.5.9 (86 versions)
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint `/audio/api/v1/transcriptions` that allows for arbitrary file upload. The application performs insufficient validation on the `file.content_type` and allows user-co…
CVE-2026-34222HIGHCVSS 7.7EG 7.7✓ Fixed in 0.8.11
2026-04-01
vulnerable: 0.1.124 ... 0.8.9 (149 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.11, there is a broken access control vulnerability in tool values. This issue has been patched in version 0.8.11.
CVE-2026-44549HIGHCVSS 7.3EG 7.3✓ Fixed in 0.8.0
2026-05-15
vulnerable: 0.1.124 ... 0.7.2 (138 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function…
CVE-2026-44550MEDIUMCVSS 5.0EG 5.0✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, FolderForm uses model_config = ConfigDict(extra='allow'), which permits arbitrary fields to pass through Pydantic validation…
CVE-2026-44551CRITICALCVSS 9.1EG 9.1✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind …
CVE-2026-44552HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the tool_servers and terminal_servers keys in utils/tools.py do use a prefix. When two or more Open WebUI instances share a …
CVE-2026-44553HIGHCVSS 8.1EG 8.1✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, administrative role changes and user deletions do not iterate SESSION_POOL to disconnect affected sessions. As a result, a u…
CVE-2026-44554HIGHCVSS 8.1EG 8.1✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/retrieval/process/web endpoint accepts a user-supplied collection_name and an overwrite query parameter (de…
CVE-2026-44555HIGHCVSS 7.6EG 7.6✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, Open WebUI supports model composition via base_model_id: a user-defined model (e.g., "Cheap Assistant") can reference an exi…
CVE-2026-44556HIGHCVSS 7.1EG 7.1✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM p…
CVE-2026-44557MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the _validate_collection_access function uses an incomplete allowlist that only enforces ownership checks for collections ma…
CVE-2026-44558MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the channel router does not call filter_allowed_access_grants on either create or update paths. A non-admin user who can cre…
CVE-2026-44559MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the GET /api/v1/channels/{id}/members endpoint only checks membership for group and dm channel types (lines 467-469). For st…
CVE-2026-44560MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the type: "file" (non-full-context), type: "text" with collection_name, and bare collection_name/collection_names paths in t…
CVE-2026-44561MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the is_user_channel_member function checks whether a ChannelMember row exists but does not check the is_active field. When a…
CVE-2026-44562MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the POST /api/v1/models/import endpoint allows users with the workspace.models_import permission to overwrite any existing m…
CVE-2026-44563MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the /api/generate, /api/embed, /api/embeddings, and /api/show endpoints accept any model name from the user and forward the …
CVE-2026-44564MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the ydoc:document:update Socket.IO event handler checks whether the sender is a member of the document's Socket.IO room (lin…
CVE-2026-44565HIGHCVSS 8.1EG 8.1✓ Fixed in 0.6.10
2026-05-15
vulnerable: 0.1.124 ... 0.6.9 (101 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.10, when uploading an audio file, the name of the file is derived from the original HTTP upload request and is not validated or…
CVE-2026-44566HIGHCVSS 7.3EG 7.3✓ Fixed in 0.1.124
2026-05-15
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, when attaching files to a promp, the name of the file is derived from the original HTTP upload request and is not validate…
CVE-2026-44567HIGHCVSS 7.3EG 7.3✓ Fixed in 0.1.124
2026-05-15
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an authorized user role of user. By default, when Open WebUI is confi…
CVE-2026-44568MEDIUMCVSS 4.8EG 4.8✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse() inside …
CVE-2026-44569HIGHCVSS 7.1EG 7.1✓ Fixed in 0.6.19
2026-05-15
vulnerable: 0.1.124 ... 0.6.9 (109 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, there's an IDOR in the channels message management system that allows authenticated users to modify or delete any message w…
CVE-2026-44570HIGHCVSS 8.3EG 8.3✓ Fixed in 0.6.19
2026-05-15
vulnerable: 0.1.124 ... 0.6.9 (109 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.19, authorization controls surrounding the memories API were inconsistent, resulting in the ability of a standard user to delet…
CVE-2026-44571MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.8.6
2026-05-15
vulnerable: 0.1.124 ... 0.8.5 (144 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, in standard channels (i.e., channels whose channel.type is neither group nor dm), the endpoint POST /api/v1/channels/{channe…
CVE-2026-44721HIGHCVSS 7.3EG 7.3✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a stored cross-site scripting (XSS) vulnerability that allows any authenticated user with model creation permission (workspa…
CVE-2026-45299MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.8.0
2026-05-15
vulnerable: 0.1.124 ... 0.7.2 (138 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, the profile_image_url field on the user profile update form accepted arbitrary data: URI values without MIME-type validation…
CVE-2026-45301HIGHCVSS 8.1EG 8.1✓ Fixed in 0.3.16
2026-05-15
vulnerable: 0.1.124 ... 0.3.9 (23 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete ever…
CVE-2026-45303HIGHCVSS 7.7EG 7.7✓ Fixed in 0.6.5
2026-05-15
vulnerable: 0.1.124 ... 0.6.4 (95 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.5, through the HTML rendering view, scripts can be injected and executed. The frontend provides a function to visualize the HTM…
CVE-2026-45314MEDIUMCVSS 6.1EG 6.1✓ Fixed in 0.9.3
2026-05-15
vulnerable: 0.1.124 ... 0.9.2 (154 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profile_image_url values, including data:image/svg+xml;base64,... p…
CVE-2026-45315HIGHCVSS 8.7EG 8.7✓ Fixed in 0.9.3
2026-05-15
vulnerable: 0.1.124 ... 0.9.2 (154 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CA…
CVE-2026-45316LOWCVSS 3.5EG 3.5✓ Fixed in 0.9.3
2026-05-15
vulnerable: 0.1.124 ... 0.9.2 (154 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the POST /api/v1/notes/{id}/pin endpoint performs a write operation (toggling the is_pinned field) but only checks for read …
CVE-2026-45317MEDIUMCVSS 4.6EG 4.6✓ Fixed in 0.9.3
2026-05-15
vulnerable: 0.1.124 ... 0.9.2 (154 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An…
CVE-2026-45318MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.9.3
2026-05-15
vulnerable: 0.1.124 ... 0.9.2 (154 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview XSS (CVE-2026-44549). The same root cause — XLSX.utils.shee…
CVE-2026-45331HIGHCVSS 8.5EG 8.5✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retrieval/web/utils.py calls validators.ipv6(ip, private=True), but the validators libr…
CVE-2026-45338HIGHCVSS 7.7EG 7.7✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in _process_picture_url() in backend/open_webui/utils/oauth.py (li…
CVE-2026-45345MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.5.7
2026-05-15
vulnerable: 0.1.124 ... 0.5.6 (76 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.7, a user can modify another user's model even if its visibility is set to Private. By changing the access permissions during e…
CVE-2026-45347MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.5.11
2026-05-15
vulnerable: 0.1.124 ... 0.5.9 (80 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.11, there is a blind server side request forgery (SSRF) via the PDF generate function. In the PDF export, user inputs are inter…
CVE-2026-45349HIGHCVSS 7.1EG 7.1✓ Fixed in 0.9.0
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (151 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a user just needs to use the API endpoint: /api/chat/completions with their own API key (generated in OWUI) and the Chat ID …
CVE-2026-45350HIGHCVSS 7.1EG 7.1✓ Fixed in 0.8.6
2026-05-15
vulnerable: 0.1.124 ... 0.8.5 (144 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, there is a vulnerability in chat completion API, which allows attackers to bypass tool restrictions, potentially enabling un…
CVE-2026-45351MEDIUMCVSS 6.5EG 6.5✓ Fixed in 0.8.9
2026-05-15
vulnerable: 0.1.124 ... 0.8.8 (147 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.9, when a regular user [non-admin] logs into the application, a http://IP:8080/api/models? web request is initiated by the appl…
CVE-2026-45365MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.8.11
2026-05-15
vulnerable: 0.1.124 ... 0.8.9 (149 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, an internal-only bypass_filter parameter is exposed on the /openai/chat/completions and /ollama/api/chat HTTP endpoints via…
CVE-2026-45385MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.9.5
2026-05-15
vulnerable: 0.1.124 ... 0.9.4 (156 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, an IDOR vulnerability exists in the Channels feature of Open WebUI, allowing any channel member to modify messages sent by o…
CVE-2026-45386MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.9.5
2026-05-15
vulnerable: 0.1.124 ... 0.9.4 (156 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, Pin/Unpin is a write operation (modifies the message's is_pinned , pinned_by, pinned_at fields), but in standard channels it…
CVE-2026-45387MEDIUMCVSS 4.3EG 4.3✓ Fixed in 0.9.5
2026-05-15
vulnerable: 0.1.124 ... 0.9.4 (156 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when setting model permissions so that a group has read access to it, intending for other users to use it, those users also …
CVE-2026-45396MEDIUMCVSS 5.4EG 5.4✓ Fixed in 0.9.5
2026-05-15
vulnerable: 0.1.124 ... 0.9.4 (156 versions)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which…

Check whether open-webui is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for open-webui CVEs against the assets you own.

Start Free Scan →