CVE-2026-45347: Open WebUI blind SSRF in PDF generation function

Executive brief

Open WebUI is an interface for interacting with large language models. A vulnerability in its PDF generation feature allows users to force the server to make unauthorized web requests to internal or external addresses. While attackers cannot directly read the data returned from these requests, they can use this flaw to map out internal network services or trigger actions on other internal systems.

Technical details

A blind Server-Side Request Forgery (SSRF) exists in Open WebUI's PDF export utility. User-controllable fields such as 'title' are interpreted as HTML and embedded into a PDF template without proper sanitization. While dangerous tags like <iframe> are blocked, <img> tags can be used to force the server to perform GET requests to arbitrary URLs. An attacker with low privileges can use this to probe internal network assets or perform port scanning via response timing analysis. The issue was resolved in version 0.5.11 by implementing HTML escaping on all user-controllable fields before they are processed by the fpdf2 library.

Affected products

• Open WebUI Open WebUI < 0.5.11

Timeline

• 2025-02: patched: First released in v0.5.11
• 2026-05-14: advisory: GitHub Advisory published

References

• https://api.github.com/users/simioni87
• https://github.com/simioni87
• https://api.github.com/users/simioni87/gists%7B/gist_id%7D
• https://api.github.com/users/simioni87/repos
• https://avatars.githubusercontent.com/u/37290182?v=4
• https://api.github.com/users/simioni87/events%7B/privacy%7D