PT-2026-1995 · Openwebui+1 · Open-Webui

Brandon Niemczyk + 2 · Published 2026-01-09 · Updated 2026-01-23 · CVE-2026-0765

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open WebUI (affected versions not specified)

Description A flaw exists in Open WebUI that allows remote attackers to execute arbitrary code. Authentication is required to exploit this issue. The vulnerability is located within the install frontmatter requirements function and stems from insufficient validation of user-supplied input before it is used in a system call. Successful exploitation could allow an attacker to execute code with the privileges of the service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-0765

ZDI-26-031

Affected Products

Open-Webui

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-0765 · Security Note
• https://osv.dev/vulnerability/CVE-2026-0765 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-031 · Security Note
• https://twitter.com/CveFindCom/status/2014558864549576853 · Twitter Post
• https://twitter.com/CVEnew/status/2014576956357202295 · Twitter Post