PT-2026-32582 · Unknown · Open-Webui

Gg0H · Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-34225

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.7.3

Description Open WebUI contains a Blind Server Side Request Forgery (SSRF) in the functionality used to edit an image via a prompt. The affected function performs a GET request to a user-provided URL without domain restrictions, enabling access to the local address space. Because the SSRF is blind, the response cannot be read, but the issue allows for port scanning of the local network by analyzing whether the GET request succeeds or fails. If a service on an open port is identified, an attacker may interact with it if that service provides state-changing GET request endpoints.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-34225

Affected Products

Open-Webui

References · 5

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-jgx9-jr5x-mvpv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34225 · Security Note
• https://twitter.com/CVEnew/status/2043976143590621435 · Twitter Post
• https://twitter.com/CVEarity/status/2044103903281852869 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043980467825697034 · Twitter Post