What is the CVSS score of CVE-2026-34225?

CVE-2026-34225 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-34225?

Yes, a public proof-of-concept exploit is available for CVE-2026-34225. Prioritise patching immediately. EPSS: 0.0%.

Open Webui CVE-2026-34225

EUVD-2026-22188 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-14 GitHub_M

GHSA-jgx9-jr5x-mvpv

SSRF Open Webui

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 02:08 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 02:00 euvd

EUVD-2026-22188

Analysis Generated

Apr 14, 2026 - 02:00 vuln.today

CVE Published

Apr 14, 2026 - 01:39 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.7.2 and below contain a Blind Server Side Request Forgery in the functionality that allows editing an image via a prompt. The affected function performs a GET request to a user-provided URL with no restriction on the domain, allowing the local address space to be accessed. Since the SSRF is blind (the response cannot be read), the primary impact is port scanning of the local network, as whether a port is open can be determined based on whether the GET request succeeds or fails. These response differentials can be automated to iterate through the entire port range and identify open ports. If the service running on an open port can be inferred, an attacker may be able to interact with it in a meaningful way, provided the service offers state-changing GET request endpoints. This issue was unresolved at the time of publication.

AnalysisAI

Blind Server-Side Request Forgery in Open WebUI 0.7.2 and below allows authenticated remote attackers to scan the local network and infer open ports via the image editing prompt functionality, which performs unrestricted GET requests to user-supplied URLs. The vulnerability enables port enumeration of internal network services without exposing response content, potentially leading to reconnaissance of locally accessible services. No public exploit code or active exploitation has been confirmed; patch status remains unresolved at time of publication.

Technical ContextAI

Open WebUI's image editing feature implements a GET request mechanism to fetch resources from user-provided URLs during prompt processing. The vulnerability stems from missing URL validation and domain restrictions (CWE-918: Server-Side Request Forgery), permitting attackers to direct requests toward internal IP address ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost services. Because the SSRF is 'blind' - server responses are not returned to the attacker - the primary attack surface is timing and HTTP status differential analysis: successful connections (HTTP 200, 301, etc.) indicate open ports, while connection timeouts or refusals indicate closed ports. This permits systematic port scanning through algorithmic iteration without direct response inspection.

RemediationAI

Upgrade Open WebUI to version 0.7.3 or later if available, or monitor the official repository and GitHub security advisory (https://github.com/open-webui/open-webui/security/advisories/GHSA-jgx9-jr5x-mvpv) for patch release announcements. As an interim workaround pending patch availability, restrict network access to Open WebUI instances through firewall rules, disable the image editing feature, or implement egress filtering to block requests to internal IP ranges and localhost addresses. Consider implementing a URL validation and allowlist policy for any user-supplied domain inputs in the image prompt functionality.