CVE-2025-29446

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-29446
open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verify_connection.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/jcxj/jcxj/blob/master/source/_posts/open-webui-ssrf%E6%BC%8F%E6%B4%9E.md Broken Link
https://github.com/l1uyi/cve-list/blob/main/cve-list/open-webui-ssrf.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:0.5.16:*:*:*:*:*:*:*
History

28 May 2025, 15:49

Type Values Removed Values Added
First Time Openwebui
Openwebui open Webui
CPE cpe:2.3:a:openwebui:open_webui:0.5.16:*:*:*:*:*:*:*
References () https://github.com/jcxj/jcxj/blob/master/source/_posts/open-webui-ssrf%E6%BC%8F%E6%B4%9E.md - () https://github.com/jcxj/jcxj/blob/master/source/_posts/open-webui-ssrf%E6%BC%8F%E6%B4%9E.md - Broken Link
References () https://github.com/l1uyi/cve-list/blob/main/cve-list/open-webui-ssrf.md - () https://github.com/l1uyi/cve-list/blob/main/cve-list/open-webui-ssrf.md - Exploit, Third Party Advisory

12 May 2025, 15:15

Type Values Removed Values Added
CWE CWE-918
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 3.3

23 Apr 2025, 14:08

Type Values Removed Values Added
Summary
  • (es) open-webui v0.5.16 es vulnerable a SSRF en routers/ollama.py en la función verify_connection.

21 Apr 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-21 17:15

Updated : 2025-05-28 15:49

NVD link : CVE-2025-29446

Mitre link : CVE-2025-29446

CVE.ORG link : CVE-2025-29446

JSON object : View

Products Affected

openwebui

  • open_webui
CWE
CWE-918

Server-Side Request Forgery (SSRF)