AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Open WebUIGHSA-9vf8-xgwm-97r8

Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

Open WebUI

CVE-2024-8053 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

Affected versions

PackageAffectedFixed in
open-webui
PyPI
<= 0.3.10No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-287, CWE-306
Also known as
CVE-2024-8053, PYSEC-2026-1725

More Open WebUI advisories

All Open WebUI