Zaloguj się
Deutsch English Español Polski
Średnia

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

  • Ujawniono: 20.03.2025
  • Aktualizacja: 11.10.2026 14:18

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Python (PyPI) open-webui < 0.3.16 0.3.16

Odnośniki

Ocena CVSS 6.9/10
Wektor CVSS
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L
Słabość (CWE)
CWE-352
Platforma
Python (PyPI)
Paczka
open-webui
Ujawniono
20.03.2025
Aktualizacja
11.10.2026 14:18

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-p5vx-9hj8-cf4h - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-1739 - PyPA Advisory Database; CC BY 4.0

Historia podatności: open-webui

Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (161) w archiwum
Wszystkich wpisów
161
Pierwsza → ostatnia
08.2024 09.2026
Bez poprawki
11
Wykorzystywana w atakach
0

Rozkład istotności

  • Krytyczna 1
  • Wysoka 77
  • Średnia 75
  • Niska 8

Ujawnienia w latach

Istotność:
  1. Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
    Wysoka · 7.5 CVE-2026-87011 >= 0.9.0, < 0.11.1 0.11.1
  2. Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
    Wysoka · 8.1 CVE-2026-87016 >= 0.6.41, < 0.11.1 0.11.1
  3. Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
    Wysoka · 8.7 CVE-2026-87995 >= 0.8.11, < 0.11.1 0.11.1
  4. Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
    Wysoka · 7.7 CVE-2026-87996 >= 0.9.6, < 0.11.1 0.11.1
  5. Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion
    Wysoka · 7.1 CVE-2026-87998 >= 0.10.0, < 0.11.1 0.11.1
  6. Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
    Wysoka · 7.1 CVE-2026-87999 < 0.11.1 0.11.1
  7. Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
    Wysoka · 8.1 CVE-2026-70494 >= 0.10.0, < 0.11.0 0.11.0
  8. Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
    Wysoka · 8.7 CVE-2026-70492 >= 0.10.0, < 0.11.0 0.11.0
  9. Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    Wysoka · 8.2 CVE-2026-70486 >= 0.9.0, < 0.11.0 0.11.0
  10. Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    Wysoka · 7.1 CVE-2026-70485 >= 0.9.0, < 0.11.0 0.11.0
  11. Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    Wysoka · 8.1 CVE-2026-70482 >= 0.8.0, < 0.11.0 0.11.0
  12. Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    Wysoka · 7.7 CVE-2026-70479 >= 0.9.6, < 0.11.0 0.11.0
  13. open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
    Wysoka · 7.7 CVE-2026-59221 >= 0.9.6, < 0.10.0 0.10.0
  14. Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)
    Wysoka · 8.0 CVE-2026-59224 < 0.10.0 0.10.0
  15. Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
    Wysoka · 7.7 CVE-2026-59216 < 0.10.0 0.10.0
  16. Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
    Wysoka · 7.1 CVE-2026-59714 >= 0.9.5, < 0.10.0 0.10.0
  17. Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout
    Wysoka · 7.1 CVE-2026-59219 >= 0.9.0, < 0.10.0 0.10.0
  18. Open WebUI: Stored web worker XSS via Pyodide
    Wysoka · 7.3 CVE-2026-59214 < 0.10.0 0.10.0
  19. Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages
    Wysoka · 7.3 CVE-2026-26193 < 0.6.44 0.6.44
  20. Open WebUI vulnerable to Stored XSS via iFrame in citations model
    Wysoka · 7.3 CVE-2026-26192 < 0.7.0 0.7.0
  21. Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
    Wysoka CVE-2025-46719 < 0.6.6 0.6.6
  22. Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
    Wysoka · 7.7 CVE-2026-54018 < 0.9.6 0.9.6
  23. Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
    Wysoka · 7.7 CVE-2026-54017 < 0.9.6 0.9.6
  24. Open WebUI: Stored XSS to Account Takeover via Model Profile Images
    Wysoka · 7.6 CVE-2026-54013 < 0.9.6 0.9.6
  25. Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
    Wysoka · 7.1 CVE-2026-54012 < 0.9.6 0.9.6
  26. Open WebUI: Stored XSS in Mermaid Markdown Preview
    Wysoka · 8.7 CVE-2026-54011 < 0.9.6 0.9.6
  27. Open WebUI: Forged chat-file link allows cross-user file read and deletion
    Wysoka · 8.3 CVE-2026-54010 < 0.9.6 0.9.6
  28. Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
    Wysoka · 8.5 CVE-2026-54008 < 0.9.6 0.9.6
  29. Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
    Wysoka · 6.5 CVE-2026-54007 < 0.9.6 0.9.6
  30. Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts
    Wysoka · 8.1 CVE-2026-45675 < 0.9.0 0.9.0
  31. Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
    Wysoka · 8.8 CVE-2026-45672 < 0.8.12 0.8.12
  32. Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion
    Wysoka · 8.0 CVE-2026-45671 < 0.9.0 0.9.0
  33. Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints
    Wysoka · 8.1 CVE-2026-45402 < 0.9.5 0.9.5
  34. Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url
    Wysoka · 7.3 CVE-2026-56398 < 0.9.5 0.9.5
  35. Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)
    Wysoka · 8.5 CVE-2026-45401 < 0.9.5 0.9.5
  36. Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`
    Wysoka · 8.5 CVE-2026-45400 < 0.9.5 0.9.5
  37. Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption
    Wysoka · 7.1 CVE-2026-45399 < 0.9.0 0.9.0
  38. Open WebUI Vulnerable to IDOR: Retrieval API Bypasses Knowledge Base Access Controls
    Wysoka · 7.5 CVE-2026-45398 < 0.9.5 0.9.5
  39. Open WebUI's chat completion API allows tool restrictions to be bypassed
    Wysoka · 7.1 CVE-2026-45350 < 0.8.6 0.8.6
  40. Open WebUI has Broken Access Control for Completions API
    Wysoka · 7.1 CVE-2026-45349 < 0.9.0 0.9.0
  41. Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)
    Wysoka · 7.7 CVE-2026-45338 < 0.9.0 0.9.0
  42. Open WebUI has a full SSRF Vulnerability in the RAG Web Search Feature
    Wysoka · 8.5 CVE-2026-45331 < 0.9.0 0.9.0
  43. Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
    Wysoka · 6.1 CVE-2026-45314 < 0.9.3 0.9.3
  44. Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
    Wysoka · 8.7 CVE-2026-45315 < 0.9.3 0.9.3
  45. Open WebUI has stored XSS via the HTML renedering view
    Wysoka · 7.7 CVE-2026-45303 < 0.6.5 0.6.5
  46. Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file
    Wysoka · 8.1 CVE-2026-45301 < 0.3.16 0.3.16
  47. Open WebUI has inconsistent authorization controls within memories API
    Wysoka · 8.3 CVE-2026-44570 < 0.6.19 0.6.19
  48. Open WebUI's Insecure Message Access Breaks Authorization
    Wysoka · 7.1 CVE-2026-44569 < 0.6.19 0.6.19
  49. Open WebUI Arbitrary File Write, Delete via Path Traversal
    Wysoka · 8.1 CVE-2026-44565 < 0.6.10 0.6.10
  50. Open WebUI has a CORS misconfiguration and session validation issue
    Wysoka · 8.3 CVE-2026-56400 < 0.3.33 0.3.33
  51. Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
    Wysoka · 7.3 CVE-2026-44566 < 0.1.124 0.1.124
  52. Open WebUI has Improper Authorization Control
    Wysoka · 7.3 CVE-2026-44567 < 0.1.124 0.1.124
  53. Open WebUI has stored XSS in Excel file preview
    Wysoka · 7.3 CVE-2026-44549 < 0.8.0 0.8.0
  54. Open WebUI has Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite
    Wysoka · 8.1 CVE-2026-44554 < 0.9.0 0.9.0
  55. Open WebUI's responses passthrough endpoint lacks access control authorization
    Wysoka · 7.1 CVE-2026-44556 < 0.9.0 0.9.0
  56. Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining
    Wysoka · 7.6 CVE-2026-44555 < 0.9.0 0.9.0
  57. Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning
    Wysoka · 8.7 CVE-2026-44552 < 0.9.0 0.9.0
  58. Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access
    Wysoka · 8.1 CVE-2026-44553 < 0.9.0 0.9.0
  59. Open WebUI has an LDAP Empty Password Authentication Bypass
    Krytyczna · 9.1 CVE-2026-44551 < 0.9.0 0.9.0
  60. open-webui Vulnerable to Stored XSS via Model Description
    Wysoka · 7.3 CVE-2026-44721 < 0.9.0 0.9.0
  61. Open WebUI has Broken Access Control in Tool Valves
    Wysoka · 7.7 CVE-2026-34222 < 0.8.11 0.8.11
  62. Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
    Wysoka · 7.1 CVE-2026-28788 < 0.8.6 0.8.6
  63. Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
    Wysoka · 8.5 CVE-2025-65958 < 0.6.37 0.6.37
  64. Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
    Wysoka · 7.3 CVE-2025-64496 < 0.6.35 0.6.35
  65. Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
    Wysoka · 8.7 CVE-2025-64495 < 0.6.35 0.6.35
  66. Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability
    Wysoka · 7.5 ghsa-5ccf-884p-4jjq <= 0.3.21 brak poprawki
  67. Open WebUI denial of service through endpoint for converting markdown
    Wysoka · 7.5 CVE-2024-7983 < 0.5.13 0.5.13
  68. Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint
    Wysoka · 7.5 CVE-2024-8053 < 0.5.13 0.5.13
  69. Open WebUI stored cross-site scripting (XSS) vulnerability
    Wysoka · 8.4 CVE-2024-7990 <= 0.3.8 brak poprawki
  70. Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions
    Wysoka · 8.1 CVE-2024-8060 < 0.5.17 0.5.17
  71. Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) ten wpis
    Średnia · 6.9 CVE-2024-7035 < 0.3.16 0.3.16
  72. Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability
    Wysoka · 8.0 CVE-2024-7806 < 0.3.33 0.3.33
  73. Open WebUI Vulnerable to a Session Fixation Attack
    Wysoka · 7.6 CVE-2024-7053 <= 0.3.8 brak poprawki
  74. Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file
    Wysoka · 7.5 ghsa-6wj5-5pgr-jwq8 < 0.4.7 0.4.7
  75. Open WebUI Allows Arbitrary File Reading and Deletion
    Wysoka · 8.1 CVE-2024-7043 < 0.3.16 0.3.16
  76. Open WebUI Uncontrolled Resource Consumption vulnerability
    Wysoka · 7.5 CVE-2024-7036 <= 0.3.8 brak poprawki
  77. Open WebUI has vulnerable dependency on starlette via fastapi
    Wysoka · 7.5 ghsa-w466-2wfc-8g58 <= 0.3.32 brak poprawki
  78. Open WebUI Uncontrolled Resource Consumption vulnerability
    Wysoka · 7.5 CVE-2024-12534 <= 0.3.32 brak poprawki
  79. Open WebUI Uncontrolled Resource Consumption vulnerability
    Wysoka · 7.5 CVE-2024-12537 <= 0.3.32 brak poprawki

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.