Openwebui Open_webui
141 CVEs affecting Openwebui Open_webui. Latest disclosed: 2026-07-15. Critical: 3, High: 68.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44551 | Critical | 9.1 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not va… |
CVE-2024-8017 | Critical | 9.0 | 2025-03-20 | An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability… |
CVE-2024-7053 | Critical | 9.0 | 2025-03-20 | A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie fo… |
CVE-2024-7044 | High | 8.9 | 2025-03-20 | A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject m… |
CVE-2026-45672 | High | 8.8 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.12, the /api/v1/utils/code/execute endpoint exe… |
CVE-2026-0766 | High | 8.8 | 2026-01-23 | Open WebUI load_tool_module_by_id Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0765 | High | 8.8 | 2026-01-23 | Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2024-7806 | High | 8.8 | 2025-03-20 | A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The applicati… |
CVE-2024-7043 | High | 8.8 | 2025-03-20 | An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether… |
CVE-2024-6707 | High | 8.8 | 2024-08-07 | Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability. |
CVE-2026-54011 | High | 8.7 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6,Open WebUI renders Mermaid blocks from Markdo… |
CVE-2026-45315 | High | 8.7 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint take… |
CVE-2026-44552 | High | 8.7 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the tool_servers and terminal_servers keys i… |
CVE-2025-65959 | High | 8.7 | 2025-12-04 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered i… |
CVE-2025-64495 | High | 8.7 | 2025-11-08 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts… |
CVE-2026-54008 | High | 8.5 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.py::_process_… |
CVE-2026-45401 | High | 8.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_… |
CVE-2026-45400 | High | 8.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a parsing difference between the urlparse an… |
CVE-2026-45331 | High | 8.5 | 2026-05-15 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, validate_url() in backend/open_webui/retriev… |
CVE-2025-65958 | High | 8.5 | 2025-12-04 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulner… |