CVE Vulnerability Catalog

Open WebUI from 0.10.0 until 0.11.1 in DELETE /api/v1/knowledge/{id}/delete authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-administrator with write access to one external knowledge base could delete shared instance configuration and make every other knowledge base using that connection unavailable.

Open WebUI from 0.10.0 to 0.11.1 fails to apply folder write-access checks when creating a new chat with a client-supplied folder_id in POST /api/chat/completions and POST /api/v1/chat/completions. An authenticated user who knows a shared folder identifier can inject a chat into a folder where they have read-only or no write access, causing the entry to appear to authorized readers. Fixed in 0.11.1.

Open WebUI from 0.9.6 until 0.11.1 in SafePlaywrightURLLoader in backend/open_webui/retrieval/web/utils.py validated a user-controlled hostname in Python and then let the Playwright browser resolve it again in the sync and async request interceptors. An authenticated user controlling authoritative DNS could return a public address to validation and an internal address to the browser, exposing responses from internal services or cloud metadata through web search or URL ingestion.

Open WebUI from 0.8.11 until 0.11.1 in src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview.

Open WebUI from 0.9.5 to 0.11.1 does not verify that the calling user authored the targeted message in the channel branch of chat_completion. A channel member can replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. Fixed in 0.11.1.

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function DBOperation.addCategory of the file includes/process.php of the component AJAX Backend. The manipulation of the argument userid results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record of the file includes/manage.php. The manipulation of the argument update_category/cid/update_brand/update_product leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Open WebUI from 0.7.0 to 0.11.1 fails to apply metadata filter in the built-in knowledge search tool, allowing an authenticated user to enumerate identifiers, names, and descriptions of inaccessible knowledge bases from the shared collection. Document text remains separate, but metadata is exposed. Fixed in 0.11.1.

Open WebUI from 0.6.41 until 0.11.1 in get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected.

In yshopmall version 3.3 and earlier, there is a Cross Site Scripting (XSS) vulnerability. The file upload endpoint /api/upload lacks file type validation. Attackers can upload files of any type, including HTML, JSP, and other executable files.

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.

In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive workflow task details and trigger unauthorized workflow executions.

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload.

A path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT before version 7.10.2 allows Web Users with Secure Folders and Secure Mail permissions to escape their sandboxed home directory and read arbitrary files.

Open WebUI from 0.6.27 to 0.11.1 incorrectly captures a cookie jar in external tools, potentially leaking user session cookies to the operator of another tool server. When multiple tool servers are attached and a session or OAuth connection is processed last, requests to a different server may include the user's Open WebUI session cookies, allowing account takeover. Fixed in 0.11.1.

Open WebUI from 0.9.0 to 0.11.1 fails to invalidate the cached user record after role changes. An administrator demoted through a trusted role header or OAuth role mapping can keep an already-open Socket.IO connection and continue reading or editing every user's collaborative notes until that connection closes. Fixed in 0.11.1.

Open WebUI from 0.10.0 to 0.11.1 allows an authenticated user to place a folder under itself or one of its descendants, creating a cycle in the folder tree. The lack of visited-folder tracking during delete and read operations enables a request that consumes CPU and memory indefinitely until repaired.

Open WebUI from 0.9.0 to 0.11.1 stores the calendar event alert_minutes value without type validation, and the scheduler compares it numerically. An authenticated user with calendar permission can store a non-numeric value that raises an exception and aborts the instance-wide alert pass, suppressing all users' reminders.

In Open WebUI from 0.9.0 to 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler fetches the OIDC discovery document and signing keys before validating the logout token, causing repeated network fetches and blocking the event loop, enabling a DoS attack on a single-worker instance.

The gf_dm_get_chunk_data function in GPAC version 26.07.0 has an out-of-bounds read that can be exploited via a crafted HTTP request, causing a denial of service. The vulnerability is fixed in a specific commit.