PYPI · SEPTEMBER 2026 · EARLY WARNING

open webui Package Vulnerability Under Investigation

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: open webui (pypi)
Patched version: 0.10.0

GHSA-3PF7-Q2G3-WJ28

An early warning has been issued for a vulnerability in the open webui package that allows any authenticated user to inject chats into another user's folder via chat completions. This issue affects versions before 0.10.0.

What happened

The open webui package, available on PyPI, has a vulnerability that allows any authenticated user to inject chats into another user's folder through chat completions. This vulnerability has been reported to affect versions before 0.10.0. The issue is currently under investigation and no exploitation in the wild has been confirmed. Users are advised to review their usage of the open webui package and assess their exposure to this vulnerability.

The vulnerability was first flagged on 2026-09-10T15:10:04+00:00 and is tracked under the ID GHSA-3PF7-Q2G3-WJ28. The open-webui/open-webui repository on GitHub has published an advisory detailing the issue. It is recommended to consult the primary sources for the most accurate and up-to-date information.

What to do about it

Upgrade to version 0.10.0 or later of the open webui package to mitigate the vulnerability.
Review your application's dependencies to ensure that the open webui package is not being used in a vulnerable version.
Monitor the primary sources for updates on the vulnerability and any additional mitigation steps that may be recommended.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If open webui is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using the open webui package in versions before 0.10.0.

What should I do right now?

Upgrade to version 0.10.0 or later of the open webui package to mitigate the vulnerability.

Is there an official fix available?

Yes, version 0.10.0 of the open webui package is the patched version.

Sources

[GHSA-3pf7-q2g3-wj28] Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions

Join the 0Day waitlist →

← Back to all threats