The vulnerability resides in the PDF generation feature of Open WebUI, where user supplied HTML is rendered into a PDF. While scripts and other dangerous tags are rejected, an image tag can be employed to trigger a server‑side GET request. This blind SSRF does not allow data theft directly but permits the attacker to probe internal services or potentially pivot further within the network, constituting a moderate confidentiality and availability risk.

The affected product is Open WebUI. The CVE payload does not specify which specific versions are impacted; the fix was released in release 0.5.11 but no version information is provided to confirm whether later releases are fully secure.

With a CVSS score of 4.3, the risk is moderate. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be a crafted image tag included in the HTML sent to the PDF export endpoint; authentication requirements are not specified in the description, but the feature is generally available to users with access to the interface.