A server‑side request forgery flaw allows an authenticated user to submit a publicly reachable URL that redirects to a private or metadata address. The backend follows the redirect without re‑checking the target against the blocked IP list, returning the internal response body to the attacker and exposing sensitive information or enabling further exploitation. The weakness is identified as CWE‑918.

All installations of Open WebUI older than version 0.9.5 are affected. The vulnerability manifests in backend functions that retrieve external content, including the web‑fetch and image‑load endpoints, and any route that uses these helpers. Users should ensure their Open WebUI instance is upgraded to 0.9.5 or later to receive the fix.

The CVSS score is 8.5, indicating high severity. While the EPSS score is not publicly available, the vulnerability is not listed in CISA's KEV catalog, suggesting that, as of the last advisory, exploitation is not confirmed. The attack requires authentication, but once authenticated the attacker can direct internal traffic through the server with ordinary HTTP requests, making the flaw powerful for data exfiltration or lateral movement within the private network.