Open WebUI EUVD-2025-201264

Requires a valid authenticated session of ANY role (PR:L) - the PoC authenticates via /api/v1/auths/signin, and no elevated permissions are needed, so instances allowing open user self-registration effectively lower this bar to anyone network-reachable. The specific exploitation surface is the /api/v1/retrieval/process/web endpoint (the web-retrieval/RAG feature), which passes form_data.url straight into get_content_from_url() with no validation of private IP ranges (RFC1918, 127.0.0.0/8), cloud metadata addresses (169.254.169.254, fd00:ec2::254), or protocols pre-fix. Limiting factors: the attacker must first authenticate; the instance must be running a version < 0.6.37; and the highest-value outcome (cloud credential theft) applies only to instances deployed in AWS/GCP/Azure environments where an instance metadata service is reachable. Isolated, fully offline, single-user deployments with no reachable internal targets substantially reduce real impact.

This is a moderate-severity, authenticated SSRF (CWE-918) with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning it is remotely reachable with low attack complexity but requires valid credentials (PR:L). Signals diverge on urgency: the CVSS vector and the vulnerability class are genuinely attractive to attackers because the GHSA advisory and public PoC confirm the server can be coerced into fetching cloud metadata endpoints (169.254.169.254 AWS/GCP/Azure), yet the EPSS score is very low at 0.04% (12th percentile), and the CVE is NOT listed in CISA KEV, indicating no confirmed mass or active exploitation in the wild. The practical gate is authentication (PR:L) combined with the fact that Open WebUI is a self-hosted platform frequently deployed internally or offline, which narrows the realistic attacker population to anyone who can obtain any user account on an instance - a low bar given Open WebUI's optional self-signup, but still a precondition. Net: this is a credible priority for any internet-exposed or multi-tenant Open WebUI instance (especially in cloud environments where metadata credential theft enables lateral escalation), but for isolated/offline single-user deployments the real-world risk is lower than the 7.1 score alone suggests. No conflict exists between CVSS and description - both agree on network vector and authenticated access. The main caveat: POC availability is confirmed, but this must not be conflated with active exploitation, which is NOT confirmed by any source here.

An attacker with any valid Open WebUI account (including a self-registered low-privilege user) sends a POST to /api/v1/retrieval/process/web with a crafted url such as http://169.254.169.254/latest/meta-data/iam/security-credentials/, and the server dutifully fetches it and returns the response body, leaking cloud IAM credentials. A working PoC is publicly available in the GHSA advisory (GHSA-c6xv-rcvw-v685), demonstrating external fetch of example.com as proof and the same path reaches internal services, firewalled hosts, and metadata endpoints. Because the attack is network-based with low complexity (AV:N/AC:L) and no user interaction, exploitation is a single authenticated HTTP request.