Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
exploitation probability
0.5%top 61% of all CVEs
observed exploitation
nono source reports it
Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
open-webui · open-webuiReferences
https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mwhttps://www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-web