Description
Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentially execute commands via instance secrets.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
open-webui open-webui
Default version status: unaffected
0 to < 0.6.27affected0.6.27unaffected
pkg:pypi/open-webuiReferences
- https://github.com/open-webui/open-webui/security/advisories/GHSA-82r6-c5jm-f3mw ↗
- https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774 ↗
- https://www.vulncheck.com/advisories/open-webui-server-side-request-forgery-via-location-redirect-in-api-v1-retrieval-process-web ↗