PT-2026-1995 · Openwebui+1 · Open-Webui

Brandon Niemczyk + 2 · Publicado 2026-01-09 · Atualizado 2026-01-23 · CVE-2026-0765

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open WebUI (affected versions not specified)

Description A flaw exists in Open WebUI that allows remote attackers to execute arbitrary code. Authentication is required to exploit this issue. The vulnerability is located within the install frontmatter requirements function and stems from insufficient validation of user-supplied input before it is used in a system call. Successful exploitation could allow an attacker to execute code with the privileges of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-0765

ZDI-26-031

Produtos afetados

Open-Webui

Referências · 5

• https://twitter.com/CveFindCom/status/2014558864549576853 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0765 · Nota de Segurança
• https://twitter.com/CVEnew/status/2014576956357202295 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-0765 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-26-031 · Nota de Segurança