open-webui vulnerabilities (PyPI)
161 vulnerabilities.
open-webuiPyPIOpen WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission4.3 Mediumopen-webuiPyPIOpen WebUI: Account enumeration via observable login timing discrepancy5.3 Mediumopen-webuiPyPIOpen WebUI: Stored web worker XSS via Pyodide7.3 Highopen-webuiPyPIOpen WebUI: Any authenticated user can read other users' private notes via Socket.IO5.3 Mediumopen-webuiPyPIOpen WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter6.3 Mediumopen-webuiPyPIOpen WebUI: RAG ACL Bypass in Milvus Multitenancy Mode6.5 Mediumopen-webuiPyPIOpen WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects7.7 Highopen-webuiPyPIOpen WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal7.7 Highopen-webuiPyPIOpen WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration4.3 Mediumopen-webuiPyPIOpen WebUI: Prompt history IDOR: unbound history_id allows cross-prompt read and deletion6.4 Mediumopen-webuiPyPIOpen WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui4.3 Mediumopen-webuiPyPIOpen WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI7.6 Highopen-webuiPyPIOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletion7.1 Highopen-webuiPyPIOpen WebUI: Stored XSS in Mermaid Markdown Preview8.7 Highopen-webuiPyPIOpen WebUI: Forged chat-file link allows cross-user file read and deletion8.3 Highopen-webuiPyPIOpen WebUI: Cross-user file disclosure via /api/chat/completions image_url field6.5 Mediumopen-webuiPyPIOpen WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`8.5 Highopen-webuiPyPIOpen WebUI: Cross-origin postMessage confirmation bypass via action:submit7.1 Highopen-webuiPyPIOpen WebUI: Calendar event re-parenting allows writing events into another user's calendar4.3 Mediumopen-webuiPyPIOpen WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts8.1 Highopen-webuiPyPIOpen WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed8.8 Highopen-webuiPyPIOpen WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion8.0 Highopen-webuiPyPIOpen WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)6.5 Mediumopen-webuiPyPIOpen WebUI: Indirect Object Reference (IDOR) in user notes6.5 Mediumopen-webuiPyPIOpen WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints8.1 Highopen-webuiPyPIOpen WebUI - Stored Cross-Site Scripting via OAuth Picture Claim SVG Data URI8.5 Highopen-webuiPyPIOpen WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints8.5 Highopen-webuiPyPIOpen WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`8.5 Highopen-webuiPyPIOpen WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption7.1 Highopen-webuiPyPIOpen WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls7.5 Highopen-webuiPyPIOpen WebUI: Unauthenticated RAG Configuration Disclosure5.3 Mediumopen-webuiPyPIOpen WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation5.4 Mediumopen-webuiPyPIOpen WebUI: Sharing models for others to use (read permission) also exposes model details (system prompt leakage)4.3 Mediumopen-webuiPyPIOpen WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint4.3 Mediumopen-webuiPyPIOpen WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint4.3 Mediumopen-webuiPyPIOpen WebUI: Authenticated users can bypass model access control via exposed query parameter5.4 Mediumopen-webuiPyPIOpen WebUI: Exposure of System Prompt to Regular User [Non-Admin]6.5 Mediumopen-webuiPyPIOpen WebUI: Chat completion API allows tool restrictions to be bypassed7.1 Highopen-webuiPyPIOpen WebUI: Broken Access Control for Completions API7.1 Highopen-webuiPyPIOpen WebUI: Blind server side request forgery (SSRF) via the PDF generate function4.3 Mediumopen-webuiPyPIOpen WebUI: Missing authorization check at the model update function - models from other users can be updated6.5 Mediumopen-webuiPyPIOpen WebUI: API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints6.5 Mediumopen-webuiPyPIOpen WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)7.7 Highopen-webuiPyPIOpen WebUI: Full SSRF Vulnerability in the RAG Web Search Feature8.5 Highopen-webuiPyPIOpen WebUI: Cross-Site Request Forgery (CSRF) via Image URL Manipulation4.6 Mediumopen-webuiPyPIOpen WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)5.4 Mediumopen-webuiPyPIOpen WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)3.5 Lowopen-webuiPyPIOpen WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image7.4 Highopen-webuiPyPIOpen WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions8.7 Highopen-webuiPyPIOpen WebUI: Stored XSS via the HTML renedering view7.7 High- Show moreLoading…