Remote Code Execution Vulnerability in Open WebUI by Open WebUI
CVE-2025-46571

5.3MEDIUM

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
5 May 2025

What is CVE-2025-46571?

Open WebUI, an offline artificial intelligence platform, has a vulnerability that allows low privileged users to upload HTML files containing JavaScript code via the '/api/v1/files/' endpoint. When these files are accessed by an admin, they can inadvertently execute malicious JavaScript, potentially leading to complete control over the admin's account and the ability to execute arbitrary code. This issue is addressed in version 0.6.6 of the platform, which contains the necessary fixes to prevent such exploitation.

Affected Version(s)

open-webui < 0.6.6

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM
https://github.com/open-webui/open-webui/commit/ef2aeb7c0...
x_refsource_MISC
https://github.com/open-webui/open-webui/blob/main/backen...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.