Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Affects: Open WebUI
Open WebUI vulnerabilities
- Product
- Open WebUI
- Vendor
- Open WebUI
- Kind
- Chat interface
Securaity has published 137 advisories for Open WebUI: 6 Critical, 53 High, 76 Medium, 2 Low.
Open WebUI is a chat interface: a web page where people can type messages and talk with AI models. It is often connected to models that the organization itself chooses. The software is made and maintained by Open WebUI, which shares its name with the product. It is typically installed and run by IT staff, developers or enthusiasts who want a chat screen for the AI models they choose to use.
Advisories
Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding
Affects: Open WebUI
Open WebUI: Stored web worker XSS via Pyodide
Affects: Open WebUI
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs…
Affects: Open WebUI
Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete
Affects: Open WebUI
Open WebUI: Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
Affects: Open WebUI
Open WebUI: Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
Affects: Open WebUI
Open WebUI: Open WebUI vulnerable to Stored XSS via iFrame in citations model
Affects: Open WebUI
Open WebUI: Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte…
Affects: Open WebUI
Open WebUI: Open WebUI allows limited stored XSS vila uploaded html file
Affects: Open WebUI
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Affects: Open WebUI
Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path…
Affects: Open WebUI
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Affects: Open WebUI
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
Affects: Open WebUI
Open WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
Affects: Open WebUI
Open WebUI: Open WebUI Prompt history IDOR: unbound history_id allows cross-prompt read and deletion
Affects: Open WebUI
Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}
Affects: Open WebUI
Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Affects: Open WebUI
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
Affects: Open WebUI
Open WebUI: Stored XSS in Mermaid Markdown Preview
Affects: Open WebUI
Open WebUI: Forged chat-file link allows cross-user file read and deletion
Affects: Open WebUI
Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
Affects: Open WebUI
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
Affects: Open WebUI
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Affects: Open WebUI
Open WebUI: Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar
Affects: Open WebUI
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
Affects: Open WebUI
Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)
Affects: Open WebUI
Open WebUI: Open WebUI has an Indirect Object Reference (IDOR) in user notes
Affects: Open WebUI
Open WebUI: Prior to 0.8.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component…
Affects: Open WebUI
Open WebUI: Authenticated users can bypass model access control via exposed query parameter [AI-ASSISTED]
Affects: Open WebUI
Open WebUI: Open WebUI Exposes System Prompt to Regular User [Non-Admin]
Affects: Open WebUI
Open WebUI: Open WebUI's chat completion API allows tool restrictions to be bypassed
Affects: Open WebUI
Open WebUI: Open WebUI vulnerable to blind server side request forgery (SSRF) via the PDF generate function
Affects: Open WebUI
Open WebUI: Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer…
Affects: Open WebUI
Open WebUI: Open WebUI missing authorization check at the model update function - models from other users…
Affects: Open WebUI
Open WebUI: Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
Affects: Open WebUI
Open WebUI: Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html}…
Affects: Open WebUI
Open WebUI: Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
Affects: Open WebUI
Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only…
Affects: Open WebUI
Open WebUI: Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Affects: Open WebUI
Open WebUI: Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
Affects: Open WebUI
Open WebUI: Open WebUI has stored XSS via the HTML renedering view
Affects: Open WebUI
Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete…
Affects: Open WebUI
Open WebUI: Open WebUI has Stored Cross-Site Scripting In Profile Picture
Affects: Open WebUI
Open WebUI: Open WebUI's Improper Authorization in Standard Channels Allows Message Updates with Read…
Affects: Open WebUI
Open WebUI: Open WebUI has inconsistent authorization controls within memories API
Affects: Open WebUI
Open WebUI: Open WebUI's Insecure Message Access Breaks Authorization
Affects: Open WebUI
Open WebUI: Open WebUI has Improper Authorization Control
Affects: Open WebUI
Open WebUI: Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
Affects: Open WebUI
Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal
Affects: Open WebUI