open-webui vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-64495Highopen-webui: Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE GHSA-5CCF-884P-4JJQHighopen-webui: Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability CVE-2024-8060Highopen-webui: Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions CVE-2024-8053Highopen-webui: Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint CVE-2024-7983Highopen-webui: Open WebUI denial of service through endpoint for converting markdown CVE-2024-7990Highopen-webui: Open WebUI stored cross-site scripting (XSS) vulnerability CVE-2024-7035Mediumopen-webui: Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)CVE-2024-7806Highopen-webui: Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability CVE-2024-7959Highopen-webui: Open WebUI has SSRF in /openai/models GHSA-6WJ5-5PGR-JWQ8Highopen-webui: Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file CVE-2024-7045Mediumopen-webui: Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read CVE-2024-7053Highopen-webui: Open WebUI Vulnerable to a Session Fixation Attack CVE-2024-7046Mediumopen-webui: Open WebUI Allows Viewing of Admin Details CVE-2024-7044Mediumopen-webui: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload CVE-2024-7033Mediumopen-webui: Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint CVE-2024-7039Highopen-webui: Open WebUI Allows Admin Deletion via API Endpoint CVE-2024-7036Highopen-webui: Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-7043Highopen-webui: Open WebUI Allows Arbitrary File Reading and Deletion CVE-2024-7034Mediumopen-webui: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint GHSA-W466-2WFC-8G58Highopen-webui: Open WebUI has vulnerable dependency on starlette via fastapi CVE-2024-12537Highopen-webui: Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-12534Highopen-webui: Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-7037Mediumopen-webui: open-webui allows writing and deleting arbitrary files CVE-2024-7041Mediumopen-webui: open-webui Insecure Direct Object Reference (IDOR) vulnerability CVE-2024-7038Lowopen-webui: open-webui allows enumeration of file names and traversal of directories by observing the error messages

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo