Open WebUI vulnerabilities

In Open WebUI prior to version 0.8.6, there is a vulnerability in the chat completion API that allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access.

In Open WebUI prior to version 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the _process_picture_url() function, allowing an attacker to force the server to make HTTP requests to internal resources.

Open WebUI prior to version 0.9.3 has a vulnerability that allows audio files with HTML extensions to be uploaded, potentially leading to the execution of malicious code in users' browsers. A user with the appropriate permissions can trick others into opening a malicious link.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.5 allowed for script injection and execution through the HTML rendering view. The chat content was embedded in an iFrame with sandbox restrictions that were largely ineffective.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.3.16 had a missing permission check in files related to API endpoints. This allowed any authenticated user to list, access, and delete every file uploaded by other users.

In Open WebUI prior to version 0.6.19, there were inconsistencies in authorization controls surrounding the memories API, allowing standard users to delete, restore, and view the contents of other users' memories.

In Open WebUI prior to version 0.6.19, there is an IDOR vulnerability in the channels message management system that allows authenticated users to modify or delete any message within channels they have access to. The issue arises from a lack of message ownership validation in the message update and delete endpoints.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.1.124 did not properly validate whether a user has an authorized role. By default, when new user sign-ups are enabled, the user role is set to 'pending', requiring administrator intervention to assign the appropriate role.

Open WebUI is an artificial intelligence platform that prior to version 0.1.124 did not validate or sanitize file names uploaded by users. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended upload directory.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.10 did not validate or sanitize file names when uploading audio files. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended uploads directory.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.8.0 previewed Excel file attachments in an unsafe manner. A crafted XLSX file payload could exploit the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.8.12 allowed any verified user to execute arbitrary Python code, even when the admin set ENABLE_CODE_EXECUTION=false. The API endpoint did not enforce this configuration, leading to unauthorized code execution.

In versions prior to 0.9.5, the validate_url() function in Open WebUI does not validate HTTP 3xx redirects, allowing authenticated users to access internal IP addresses via public URLs. This may lead to unauthorized reading of data from internal resources.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.9.5, a parsing difference between the urlparse and requests libraries led to an SSRF bypass vulnerability.

In Open WebUI prior to version 0.9.5, a vulnerability allows authenticated users to access private knowledge bases by knowing the UUID. This flaw also enables attackers to inject or overwrite content in other users' knowledge bases.

Open WebUI is an artificial intelligence platform that prior to version 0.9.5 did not check tool management permissions during tool updates. This allows users who have been denied permissions to replace the server-side Python content of a tool, potentially leading to unauthorized code execution.

Open WebUI prior to version 0.9.0 contained an XSS vulnerability that allowed authenticated users with model creation permissions to execute arbitrary JavaScript in the browsers of other users, including admins, who viewed the malicious model in the chat UI.

In Open WebUI prior to version 0.9.0, any authenticated user could permanently delete files owned by other users via DELETE /api/v1/files/{id} if the target file was referenced in any shared chat. The has_access_to_file() authorization gate did not check the requesting user's identity or the type of operation being performed.

Open WebUI is an artificial intelligence platform that, prior to version 0.9.0, allowed authenticated users with low privileges to enumerate active background tasks and stop tasks belonging to other users. This represents a serious authorization vulnerability affecting integrity and usability in multi-user environments.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 allowed users to continue another user's conversation using their Chat ID and their own API key.

In versions prior to 0.9.0 of the Open WebUI platform, the validate_url() function improperly validates IPv6 addresses, allowing any address to pass through the filter. Additionally, IPv4-mapped IPv6 addresses and several reserved IPv4 ranges are not blocked.

In versions prior to 0.9.0, the /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests to LLM providers without enforcing per-model access control. This allows any authenticated user to interact with any model configured on the instance.

Open WebUI prior to version 0.9.0 has a vulnerability that allows users with default model creation permissions to create chained models referencing restricted base models. Access verification for base models is not performed, enabling unauthorized access.

Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.9.0 did not verify user permissions for modifying data collections. The POST /api/v1/retrieval/process/web endpoint accepted parameters that could lead to unauthorized deletion of data collections.

Open WebUI is an offline AI platform that prior to version 0.9.0 did not update the session pool after administrative role changes and user deletions. A user whose admin role was revoked retained admin privileges within their existing Socket.IO session as long as they kept the connection alive.

In versions prior to 0.9.0 of Open WebUI, the tool_servers and terminal_servers keys in utils/tools.py do not use a prefix, leading to key collisions when multiple instances share a Redis database. This can result in one instance overwriting the tool server configuration of another instance.

Command injection vulnerability in the load_tool_module_by_id function in Open WebUI allows remote attackers to execute arbitrary code. Authentication is required. The issue results from lack of proper validation of a user-supplied string before using it to execute Python code.

Command injection vulnerability in the install_frontmatter_requirements function in Open WebUI allows remote attackers to execute arbitrary code. Authentication is required. The issue results from lack of proper validation of a user-supplied string before using it to execute a system call.

In versions prior to 0.9.0 of the Open WebUI platform, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accepts password as a string with no minimum length requirement, allowing an empty string to pass validation.

Open WebUI from 0.9.5 before 0.10.0 allows any authenticated user to overwrite message content in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. Fixed in version 0.10.0.

In Open WebUI from 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler allowed a user with write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The authorization check did not require ownership or administrator status, and the cascade was bound to the owner's id. A collaborator can destroy the owner's subtree or force-move chats out of it.

Open WebUI versions 0.9.6 through 0.11.0 have a DoS vulnerability in the knowledge search path. Patterns containing regex metacharacters are compiled with Python's backtracking re engine and run without time limit, allowing an attacker to pin a CPU core and block the event loop. The issue is fixed in version 0.11.0.

In Open WebUI from 0.10.0 until 0.11.0, the KatexRenderer.svelte component could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. The catch branch inserted the original math source into the page as HTML through {@html}, allowing script execution in the browser of anyone who views the message, including shared chats and channels. The viewer's session token can be stolen, and an administrator viewer can have their account taken over.

In Open WebUI version 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields.

Open WebUI from 0.8.8 to 0.11.0 has a vulnerability in the terminal WebSocket route that authenticates its own first-message JWT and never applies the verified-user role gate. An account with pending role, including unapproved or deactivated accounts, can open an interactive terminal session when at least one terminal server is configured. Fixed in 0.11.0.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.

Open WebUI from 0.9.6 to 0.11.0 has a vulnerability in the sync cleanup endpoint that authorizes write access to a knowledge base in the URL but acts on directory and file ids from the request body without checking ownership. A user with write access to one knowledge base can delete directories and remove file embeddings from another knowledge base. Fixed in 0.11.0.

Open WebUI from 0.8.8 until 0.11.0 accepts client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge tools return indexed chunks from that file, causing a read-only cross-user confidentiality loss. This issue is fixed in 0.11.0.

Open WebUI prior to 0.11.0 resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but HTTP clients resolved the hostname again at connection time. An authenticated attacker controlling DNS could answer with a public address during validation and an internal one during connection, reaching internal services or cloud metadata, with most paths returning the response to the attacker and the OAuth path forwarding the OAuth access token. Fixed in 0.11.0.

Open WebUI from 0.9.0 until 0.11.0 has a vulnerability in the terminal file-preview serveUrl iframe branch, which always grants allow-same-origin and allow-scripts for HTML files. Any authenticated user with access to a configured terminal server could cause script execution in the Open WebUI origin, steal the victim's session token, and take over the account, with possible server-side code execution if the victim was an admin.

Open WebUI from 0.9.0 to 0.11.0 checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or cloud-metadata IPv4 address in the NAT64 well-known prefix, pass the filter, and receive the internal response body through RAG URL ingestion, URL-to-markdown conversion, or web-search content retrieval.

Open WebUI from version 0.7.0 to 0.11.0 contains a vulnerability where the legacy chat-completions feature ignores the client-supplied image_generation flag and fails to re-check the image_generation permission. An authenticated user with revoked image-generation permission can still consume the configured image provider through chat completions.

Open WebUI versions 0.9.6 through 0.11.0 allow an authenticated user to cancel another user's in-flight tasks (e.g., model response generation) by knowing the chat ID. This occurs because the delete operation cancels tasks before checking permissions. The issue is fixed in version 0.11.0.

Open WebUI from 0.8.0 until 0.11.0 has a vulnerability in the OAuth token exchange mechanism. When ENABLE_OAUTH_TOKEN_EXCHANGE=True, /oauth/{provider}/token/exchange accepts a raw provider access token and validates it without confirming which OAuth client the token was issued to. Anyone holding an access token for any client registered with the same provider could exchange it for an Open WebUI session as that token user.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.

Open WebUI from 0.6.34 to 0.11.0 renders vega and vega-lite fenced code blocks in chat content by building a Vega view without a restricted resource loader. A user who can place such a block can make another user's browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets.

Open WebUI from 0.9.6 to 0.11.0, with WEB_LOADER_ENGINE=playwright, validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated user can use JavaScript to reach blocked internal addresses, and returned DOM can include data read from those addresses in web-search or RAG output.

The vulnerability in open-webui before version 0.3.14 is due to a misconfigured CORS policy that allows arbitrary origins (allow_origins=*) and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the open-webui instance by crafting malicious cross-site requests when an admin user visits attacker-controlled websites.

Open WebUI before version 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow. The MIME type of the profile picture URL is inferred from the file extension rather than the Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users visiting the profile image endpoint receive attacker-controlled SVG content, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

A vulnerability in Open WebUI before version 0.10.0 allows bypassing proxy path normalization by encoding the '../' sequence nine times in percent-encoded format. The _sanitize_proxy_path function decodes paths only eight times, enabling an attacker to access files outside the allowed directory.