GitHub Advisoryadvisory · PyPI

GHSA-9vf8-xgwm-97r8 Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-8053
Ecosystem
PyPI
Packages
open-webui
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-287, CWE-306
Reviewed
2025-03-21

Affected packages

• PyPI open-webui: <= 0.3.10 (no fix yet)

Description

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

Related

Alias · CVE (1)

  • CVE-2024-8053 In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References