A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability

Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Open WebUI: Stored XSS in excel file preview

Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Enable Cross-Instance Cache Poisoning

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url`

Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url`

Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints

Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature

Open WebUI: Forged chat-file link allows cross-user file read and deletion

Open WebUI: Inconsistent authorization controls within memories API

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation…

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order

Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal

Open WebUI: Missing permission check in files API allows authenticated users to list, access and delete every uploaded file

Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite

Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

Open WebUI has unauthorized deletion of knowledge files

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py)

Open WebUI: Stored XSS via the HTML renedering view

Open WebUI has Broken Access Control in Tool Valves

Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI

Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining

Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout

Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication

Open WebUI: Open WebUI Improper Authorization Control

Open WebUI: Stored XSS via Model Description

Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion