Iniciar sesión
Deutsch English Español Polski
Alta

Open WebUI Allows Arbitrary File Reading and Deletion

  • Publicada: 20.03.2025
  • Actualizado: 11.10.2026 14:18

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all files uploaded by users, which includes the ID values. The attacker can then use the GET /api/v1/files/{file_id} interface to obtain information on any file and the DELETE /api/v1/files/{file_id} interface to delete any file.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) open-webui < 0.3.16 0.3.16

Referencias

Puntuación CVSS 8.1/10
Vector CVSS
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Debilidad (CWE)
CWE-821, CWE-862
Plataforma
Python (PyPI)
Paquete
open-webui
Publicada
20.03.2025
Actualizado
11.10.2026 14:18

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-jrhc-9qg9-4qfq - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-1737 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: open-webui

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (161) en el archivo
Entradas en total
161
Primera → última
08.2024 09.2026
Sin corrección
11
Explotada en ataques
0

Distribución por gravedad

  • Crítica 1
  • Alta 77
  • Media 75
  • Baja 8

Divulgaciones por año

Gravedad:
  1. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
    Alta · 7.5 CVE-2026-87011 >= 0.9.0, < 0.11.1 0.11.1
  2. Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
    Alta · 8.1 CVE-2026-87016 >= 0.6.41, < 0.11.1 0.11.1
  3. Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
    Alta · 8.7 CVE-2026-87995 >= 0.8.11, < 0.11.1 0.11.1
  4. Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
    Alta · 7.7 CVE-2026-87996 >= 0.9.6, < 0.11.1 0.11.1
  5. Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
    Alta · 7.1 CVE-2026-87998 >= 0.10.0, < 0.11.1 0.11.1
  6. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
    Alta · 7.1 CVE-2026-87999 < 0.11.1 0.11.1
  7. Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
    Alta · 8.1 CVE-2026-70494 >= 0.10.0, < 0.11.0 0.11.0
  8. Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
    Alta · 8.7 CVE-2026-70492 >= 0.10.0, < 0.11.0 0.11.0
  9. Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    Alta · 8.2 CVE-2026-70486 >= 0.9.0, < 0.11.0 0.11.0
  10. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    Alta · 7.1 CVE-2026-70485 >= 0.9.0, < 0.11.0 0.11.0
  11. Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    Alta · 8.1 CVE-2026-70482 >= 0.8.0, < 0.11.0 0.11.0
  12. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    Alta · 7.7 CVE-2026-70479 >= 0.9.6, < 0.11.0 0.11.0
  13. open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
    Alta · 7.7 CVE-2026-59221 >= 0.9.6, < 0.10.0 0.10.0
  14. Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
    Alta · 8.0 CVE-2026-59224 < 0.10.0 0.10.0
  15. Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
    Alta · 7.7 CVE-2026-59216 < 0.10.0 0.10.0
  16. Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
    Alta · 7.1 CVE-2026-59714 >= 0.9.5, < 0.10.0 0.10.0
  17. Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
    Alta · 7.1 CVE-2026-59219 >= 0.9.0, < 0.10.0 0.10.0
  18. Open WebUI: Stored web worker XSS via Pyodide
    Alta · 7.3 CVE-2026-59214 < 0.10.0 0.10.0
  19. Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
    Alta · 7.3 CVE-2026-26193 < 0.6.44 0.6.44
  20. Open WebUI vulnerable to Stored XSS via iFrame in citations model
    Alta · 7.3 CVE-2026-26192 < 0.7.0 0.7.0
  21. Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
    Alta CVE-2025-46719 < 0.6.6 0.6.6
  22. Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
    Alta · 7.7 CVE-2026-54018 < 0.9.6 0.9.6
  23. Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
    Alta · 7.7 CVE-2026-54017 < 0.9.6 0.9.6
  24. Open WebUI: Stored XSS to Account Takeover via Model Profile Images
    Alta · 7.6 CVE-2026-54013 < 0.9.6 0.9.6
  25. Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
    Alta · 7.1 CVE-2026-54012 < 0.9.6 0.9.6
  26. Open WebUI: Stored XSS in Mermaid Markdown Preview
    Alta · 8.7 CVE-2026-54011 < 0.9.6 0.9.6
  27. Open WebUI: Forged chat-file link allows cross-user file read and deletion
    Alta · 8.3 CVE-2026-54010 < 0.9.6 0.9.6
  28. Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
    Alta · 8.5 CVE-2026-54008 < 0.9.6 0.9.6
  29. Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
    Alta · 6.5 CVE-2026-54007 < 0.9.6 0.9.6
  30. Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
    Alta · 8.1 CVE-2026-45675 < 0.9.0 0.9.0
  31. Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
    Alta · 8.8 CVE-2026-45672 < 0.8.12 0.8.12
  32. Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
    Alta · 8.0 CVE-2026-45671 < 0.9.0 0.9.0
  33. Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
    Alta · 8.1 CVE-2026-45402 < 0.9.5 0.9.5
  34. Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
    Alta · 7.3 CVE-2026-56398 < 0.9.5 0.9.5
  35. Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
    Alta · 8.5 CVE-2026-45401 < 0.9.5 0.9.5
  36. Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
    Alta · 8.5 CVE-2026-45400 < 0.9.5 0.9.5
  37. Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
    Alta · 7.1 CVE-2026-45399 < 0.9.0 0.9.0
  38. Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
    Alta · 7.5 CVE-2026-45398 < 0.9.5 0.9.5
  39. Open WebUI's chat completion API allows tool restrictions to be bypassed
    Alta · 7.1 CVE-2026-45350 < 0.8.6 0.8.6
  40. Open WebUI has Broken Access Control for Completions API
    Alta · 7.1 CVE-2026-45349 < 0.9.0 0.9.0
  41. Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
    Alta · 7.7 CVE-2026-45338 < 0.9.0 0.9.0
  42. Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
    Alta · 8.5 CVE-2026-45331 < 0.9.0 0.9.0
  43. Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
    Alta · 6.1 CVE-2026-45314 < 0.9.3 0.9.3
  44. Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
    Alta · 8.7 CVE-2026-45315 < 0.9.3 0.9.3
  45. Open WebUI has stored XSS via the HTML renedering view
    Alta · 7.7 CVE-2026-45303 < 0.6.5 0.6.5
  46. Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
    Alta · 8.1 CVE-2026-45301 < 0.3.16 0.3.16
  47. Open WebUI has inconsistent authorization controls within memories API
    Alta · 8.3 CVE-2026-44570 < 0.6.19 0.6.19
  48. Open WebUI's Insecure Message Access Breaks Authorization
    Alta · 7.1 CVE-2026-44569 < 0.6.19 0.6.19
  49. Open WebUI Arbitrary File Write, Delete via Path Traversal
    Alta · 8.1 CVE-2026-44565 < 0.6.10 0.6.10
  50. Open WebUI has a CORS misconfiguration and session validation issue
    Alta · 8.3 CVE-2026-56400 < 0.3.33 0.3.33
  51. Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
    Alta · 7.3 CVE-2026-44566 < 0.1.124 0.1.124
  52. Open WebUI has Improper Authorization Control
    Alta · 7.3 CVE-2026-44567 < 0.1.124 0.1.124
  53. Open WebUI has stored XSS in Excel file preview
    Alta · 7.3 CVE-2026-44549 < 0.8.0 0.8.0
  54. Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
    Alta · 8.1 CVE-2026-44554 < 0.9.0 0.9.0
  55. Open WebUI's responses passthrough endpoint lacks access control authorization
    Alta · 7.1 CVE-2026-44556 < 0.9.0 0.9.0
  56. Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
    Alta · 7.6 CVE-2026-44555 < 0.9.0 0.9.0
  57. Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
    Alta · 8.7 CVE-2026-44552 < 0.9.0 0.9.0
  58. Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
    Alta · 8.1 CVE-2026-44553 < 0.9.0 0.9.0
  59. Open WebUI has an LDAP Empty Password Authentication Bypass
    Crítica · 9.1 CVE-2026-44551 < 0.9.0 0.9.0
  60. open-webui Vulnerable to Stored XSS via Model Description
    Alta · 7.3 CVE-2026-44721 < 0.9.0 0.9.0
  61. Open WebUI has Broken Access Control in Tool Valves
    Alta · 7.7 CVE-2026-34222 < 0.8.11 0.8.11
  62. Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
    Alta · 7.1 CVE-2026-28788 < 0.8.6 0.8.6
  63. Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
    Alta · 8.5 CVE-2025-65958 < 0.6.37 0.6.37
  64. Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
    Alta · 7.3 CVE-2025-64496 < 0.6.35 0.6.35
  65. Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
    Alta · 8.7 CVE-2025-64495 < 0.6.35 0.6.35
  66. Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability
    Alta · 7.5 ghsa-5ccf-884p-4jjq <= 0.3.21 sin corrección
  67. Open WebUI denial of service through endpoint for converting markdown
    Alta · 7.5 CVE-2024-7983 < 0.5.13 0.5.13
  68. Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint
    Alta · 7.5 CVE-2024-8053 < 0.5.13 0.5.13
  69. Open WebUI stored cross-site scripting (XSS) vulnerability
    Alta · 8.4 CVE-2024-7990 <= 0.3.8 sin corrección
  70. Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
    Alta · 8.1 CVE-2024-8060 < 0.5.17 0.5.17
  71. Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
    Alta · 8.0 CVE-2024-7806 < 0.3.33 0.3.33
  72. Open WebUI Vulnerable to a Session Fixation Attack
    Alta · 7.6 CVE-2024-7053 <= 0.3.8 sin corrección
  73. Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file
    Alta · 7.5 ghsa-6wj5-5pgr-jwq8 < 0.4.7 0.4.7
  74. Open WebUI Allows Arbitrary File Reading and Deletion esta entrada
    Alta · 8.1 CVE-2024-7043 < 0.3.16 0.3.16
  75. Open WebUI Uncontrolled Resource Consumption vulnerability
    Alta · 7.5 CVE-2024-7036 <= 0.3.8 sin corrección
  76. Open WebUI has vulnerable dependency on starlette via fastapi
    Alta · 7.5 ghsa-w466-2wfc-8g58 <= 0.3.32 sin corrección
  77. Open WebUI Uncontrolled Resource Consumption vulnerability
    Alta · 7.5 CVE-2024-12534 <= 0.3.32 sin corrección
  78. Open WebUI Uncontrolled Resource Consumption vulnerability
    Alta · 7.5 CVE-2024-12537 <= 0.3.32 sin corrección

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.