Server-Side Request Forgery Vulnerability in Open WebUI by Open WebUI
CVE-2025-65958

8.5HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
4 December 2025

What is CVE-2025-65958?

Open WebUI, a self-hosted AI platform, has a Server-Side Request Forgery (SSRF) vulnerability that enables authenticated users to manipulate server HTTP requests. This flaw can be exploited to target arbitrary URLs, allowing access to cloud metadata endpoints and internal services behind firewalls without requiring advanced permissions. Versions prior to 0.6.37 are susceptible to these operations, which can lead to potential data breaches and unauthorized information access.

Affected Version(s)

open-webui < 0.6.37

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM
https://github.com/open-webui/open-webui/commit/02238d311...
x_refsource_MISC

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.