AI agent vulnerability · Open WebUI

CVE-2024-8053: Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

highCVSS 3.1 7.5GHSA-9vf8-xgwm-97r8

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS).

Published Mar 20, 2025 · Updated Mar 27, 2025

Affected packages

open-webui

Ecosystem: PyPI
Affected: <= 0.3.10
Fixed in: No patched version yet
Check: pip show open-webui

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Open WebUI vulnerabilities

All Open WebUI entries