SB2026051163 - Server-Side Request Forgery (SSRF) in Open WebUI

Description

This security bulletin contains information about 1 vulnerability.

1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-45347)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to trigger arbitrary server-side GET requests.

The vulnerability exists due to server-side request forgery in the PDF generate function when processing user-supplied HTML during PDF export. A remote user can inject a crafted image tag to trigger arbitrary server-side GET requests.

The issue is blind, so responses could not be read during testing, but internal assets may be enumerated through response delays.

Remediation

Install update from vendor's website.

References

• https://github.com/open-webui/open-webui/security/advisories/GHSA-f776-fp4w-266c
• https://github.com/open-webui/open-webui/commit/167c8bf00d165af523acfc3b870749f6be6d3e57