Executive brief
Open WebUI, a popular interface for interacting with large language models, contains a vulnerability in its image editing feature. An attacker can use this flaw to probe the internal network where the software is hosted, potentially identifying other active services or devices. This could lead to further unauthorized access to internal systems or sensitive infrastructure information.
Technical details
A blind Server-Side Request Forgery (SSRF) exists in the `load_url_image` function within `backend/open_webui/routers/images.py`. The application blindly trusts user-provided URLs and fetches them using `requests.get` without restricting access to the local address space. While the response content is not directly returned to the user, an attacker can use response differentials (success vs. failure) to perform port scanning of the local network. This requires an authenticated user to send a crafted POST request to the `/api/v1/images/edit` endpoint. As of the advisory date, no patched version is specified for versions 0.7.2 and below.
Affected products
- Open WebUI Open WebUI <= 0.7.2
Timeline
- 2026-04-12: disclosed: Vulnerability reported to vendor
- 2026-04-14: advisory: NVD publication date
- 2026-07-07: advisory: GitHub Advisory published