Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 27, 2026 · NIST NVD

   Detected

   Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a whose message — including the server's absolute path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all d

2. Jun 17, 2026 · NIST NVD

   Updated

   Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a whose message — including the server's absolute path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all d

Affected

• cpe openwebui/open webuiversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-28786

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28786

  Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a whose mes

  nvd.nist.gov

References

• Exploit · github.com