Read the docs

open-webui

Records176All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high79CVSS 7.0–8.9

Exploited now

open-webui records in CISA KEV

No open-webui vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Open Webui 155 records HIGH

Records

176 records

TI-2024-06216 CVE-2024-6707 · GHSA-67jr-crfx-vm73

Open WebUI Arbitrary File Upload + Path Traversal

Priority HIGH 79

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01003 Published 2024-08-07 No fix listed CWE-22
TI-2024-07467 CVE-2024-8053 · GHSA-9vf8-xgwm-97r8

Improper Authentication in open-webui/open-webui

Priority HIGH 75

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00652 Published 2025-03-20 No fix listed CWE-306
TI-2024-07431 CVE-2024-8017 · GHSA-82mg-566w-vpxp

Cross-site Scripting (XSS) in open-webui/open-webui

Priority HIGH 74

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips.

CVSS 3.0CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00614 Published 2025-03-20 No fix listed CWE-79
TI-2026-38960 CVE-2026-54011 · GHSA-v8qj-hxv7-mgvv

Open WebUI: Stored XSS in Mermaid Markdown Preview

Priority HIGH 73

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00336 Published 2026-06-23 Fixed in 0.9.6 CWE-79
TI-2026-32461 CVE-2026-44549 · GHSA-jwf8-pv5p-vhmc

Open WebUI: Stored XSS in excel file preview

Priority HIGH 73

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00318 Published 2026-05-15 Fixed in 0.8.0 CWE-79
TI-2024-06530 CVE-2024-7043 · GHSA-jrhc-9qg9-4qfq

Improper Access Control in open-webui/open-webui

Priority HIGH 73

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0061 Published 2025-03-20 No fix listed CWE-862
TI-2026-71106 CVE-2026-109290 · GHSA-39h3-jjqw-8pch

Stored cross-site scripting in Open WebUI via DOCX preview

Priority HIGH 72

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00313 Published 2026-10-12 Fixed in 0.11.4 CWE-1021
TI-2024-07402 CVE-2024-7983 · GHSA-5v9m-57mq-qc75

Denial of Service in open-webui/open-webui

Priority HIGH 72

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2025-03-20 No fix listed CWE-770
TI-2024-06531 CVE-2024-7044 · GHSA-j274-m559-cj4j

Stored XSS in open-webui/open-webui

Priority HIGH 72

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00529 Published 2025-03-20 No fix listed CWE-79
TI-2026-32479 CVE-2026-44567 · GHSA-4vg5-rp28-gvjf

Open WebUI: Open WebUI Improper Authorization Control

Priority HIGH 71

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0023 Published 2026-05-15 Fixed in 0.1.124 CWE-602
Load more
Open these records in search →