VulertSecurity VulertSecurity

Vulnerability Database · PyPI · open-webui · Version

open-webui 0.12.3

0.12.3 is affected by 48 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 0.12.3.

Critical 0 High 21 Medium 22 Low 5 Unrated 0

All open-webui versions & vulnerabilities → Search the database for this package →
Released 16 Oct 2026 Status latest release Licence non-standard Also known from other sources 0 Newer releases 170 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

open-webui 0.12.3 vulnerabilities

48 vulnerabilities cover open-webui 0.12.3. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-7990: Open WebUI Stored XSS Vulnerability in open-webui Package 8.4 high No fix published 07 Jul 2026
CVE-2024-7990: Open WebUI Stored XSS Vulnerability in open-webui Package 8.4 high No fix published 20 Mar 2025
CVE-2024-7039: Open WebUI Improper Privilege Management Allows Admin Deletion via API 8.3 high No fix published 07 Jul 2026
CVE-2024-7039: Open WebUI Admin Deletion Vulnerability via API Endpoint 8.3 high No fix published 20 Mar 2025
CVE-2024-7043: Open WebUI Arbitrary File Reading and Deletion Vulnerability 8.1 high No fix published 07 Jul 2026
CVE-2024-7043: Open WebUI Arbitrary File Reading and Deletion Vulnerability 8.1 high No fix published 20 Mar 2025
CVE-2024-7959: Open WebUI SSRF Vulnerability in open-webui Package 7.7 high No fix published 07 Jul 2026
CVE-2024-7959: Open-WebUI SSRF Vulnerability in open-webui Package 7.7 high No fix published 20 Mar 2025
CVE-2024-7053: Open WebUI Session Fixation Vulnerability 7.6 high No fix published 07 Jul 2026
CVE-2024-7053: Open WebUI Session Fixation Vulnerability 7.6 high No fix published 20 Mar 2025
CVE-2024-8053: Open WebUI PDF Endpoint Lacks Authentication Leading to Potential DoS 7.5 high No fix published 07 Jul 2026
CVE-2024-7983: Open WebUI Denial of Service via Unauthenticated Markdown Conversion 7.5 high No fix published 07 Jul 2026
CVE-2024-7036: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2024-12537: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2024-12534: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2024-7983: Open WebUI Denial of Service via Unauthenticated Markdown Conversion Endpoint 7.5 high No fix published 20 Mar 2025
CVE-2024-8053: Open WebUI PDF Endpoint Lacks Authentication Leading to Potential DoS 7.5 high No fix published 20 Mar 2025
CVE-2024-7036: Open WebUI Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2024-12868: Open WebUI Vulnerable to Denial of Service via Starlette Dependency 7.5 high No fix published 20 Mar 2025
CVE-2024-12534: Open-webui Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2024-12537: Open WebUI Uncontrolled Resource Consumption Vulnerability 7.5 high No fix published 20 Mar 2025
CVE-2024-7035: Open-webui Vulnerable to Cross-Site Request Forgery (CSRF) 6.9 medium No fix published 07 Jul 2026
Cross-Site Request Forgery (CSRF) Vulnerability in Open WebUI (v0.3.8) 6.9 medium No fix published 20 Mar 2025
CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload 6.8 medium No fix published 07 Jul 2026
CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload 6.8 medium No fix published 20 Mar 2025
CVE-2024-7034: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7033: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7037: open-webui Arbitrary File Write and Delete Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7041: open-webui Insecure Direct Object Reference (IDOR) Vulnerability 6.5 medium No fix published 07 Jul 2026
CVE-2024-7034: Open WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 20 Mar 2025
CVE-2024-7033: Open-WebUI Arbitrary File Write Vulnerability 6.5 medium No fix published 20 Mar 2025
CVE-2024-7037: open-webui Arbitrary File Write and Delete Vulnerability 6.5 medium No fix published 09 Oct 2024
CVE-2024-7041: open-webui Insecure Direct Object Reference (IDOR) Vulnerability 6.5 medium No fix published 09 Oct 2024
CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability 6.1 medium No fix published 07 Jul 2026
CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability 6.1 medium No fix published 08 Aug 2024
CVE-2026-0767: Open WebUI Cleartext Transmission of Credentials Information Disclosure Vulnerability 5.3 medium No fix published 23 Jan 2026
CVE-2024-7040: Open WebUI Improper Access Control Vulnerability 4.9 medium No fix published 20 Mar 2025
CVE-2026-34225: Open WebUI Blind Server Side Request Forgery in Image Edit Functionality 4.3 medium No fix published 13 Jul 2026
CVE-2026-34225: Open WebUI Blind Server Side Request Forgery in Image Edit Functionality 4.3 medium No fix published 07 Jul 2026
CVE-2024-7045: Open WebUI Arbitrary Prompt Read Due to Improper Access Control 4.3 medium No fix published 07 Jul 2026
CVE-2024-7046: Open WebUI Admin Details Exposure Vulnerability 4.3 medium No fix published 07 Jul 2026
Improper Access Control in Open WebUI: Admin Details Exposure 4.3 medium No fix published 20 Mar 2025
CVE-2024-7045: Open WebUI Arbitrary Prompt Read Due to Improper Access Control 4.3 medium No fix published 20 Mar 2025
CVE-2025-15603: Open WebUI JWT Key Handler Insufficient Randomness Vulnerability 3.7 low No fix published 09 Mar 2026
CVE-2024-7038: open-webui File Enumeration and Directory Traversal Vulnerability 2.7 low No fix published 07 Jul 2026
CVE-2024-7038: open-webui Information Disclosure via File Enumeration and Directory Traversal 2.7 low No fix published 09 Oct 2024
CVE-2025-63681: open-webui Vulnerable to Incorrect Access Control 2.1 low No fix published 07 Jul 2026
CVE-2025-63681: open-webui Vulnerable to Incorrect Access Control 2.1 low No fix published 04 Dec 2025

Looking for another version, or everything Vulert holds for open-webui?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About open-webui 0.12.3

Is open-webui 0.12.3 vulnerable?

Yes. 48 vulnerabilities in the Vulert database cover open-webui 0.12.3: 0 critical, 21 high, 22 medium and 5 low. The upgrade Vulert recommends is 0.12.3, and each entry above names the fixed version to move to.

Which version of open-webui should I use instead of 0.12.3?

0.12.3 is the version Vulert recommends for this release line, which is also the release the publisher currently ships. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.12.3 the latest release of open-webui?

Yes. 0.12.3 is the current release, published 16 Oct 2026. Staying on the current line is what keeps you inside the publisher's fixes.

How do I monitor open-webui for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the open-webui version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.