PT-2025-49128 · Unknown · Open-Webui

Published 2025-12-04 · Updated 2025-12-10 · CVE-2025-65958

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.37

Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. A Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. The vulnerability requires only basic authentication and does not require special permissions. The vulnerability is exploitable via making requests to arbitrary URLs through the server.

Recommendations Update to version 0.6.37 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-65958

GHSA-C6XV-RCVW-V685

Affected Products

Open-Webui

References · 14

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65958.json · Exploit
• https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-65958 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65958 · Vendor Advisory
• https://reddit.com/r/VulnMatter/comments/1peus6e/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://twitter.com/CveFindCom/status/1996680716453548532 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1peorgc/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1pevkbf/resumen_diario_de_vulnerabilidades_05122025 · Reddit Post
• https://twitter.com/dailycve/status/1998807992544932351 · Twitter Post
• https://t.me/cveNotify/145327 · Telegram Post
• https://twitter.com/CVEnew/status/1996675661902021037 · Twitter Post
• https://t.me/cveNotify/145195 · Telegram Post
• https://twitter.com/CheckmarxZero/status/1998148752457019513 · Twitter Post