Open WebUI is a self‑hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.9.6, its SafePlaywrightURLLoader implemented a validate_url function that checks a user‑supplied URL’s IP address to prevent SSRF attacks. The validation, however, only applies to the initial URL. Because Playwright automatically follows HTTP redirects (301/302), an attacker can supply a seemingly safe external URL that redirects to a restricted internal network address such as localhost, a Docker container network, or cloud metadata. This bypasses the check and permits the application to access internal services even though ENABLE_RAG_LOCAL_WEB_FETCH is set to False. The vulnerability was fixed in 0.9.6. This flaw enables Server‑Side Request Forgery (CWE‑918).

All installations of Open WebUI running a version prior to 0.9.6 are affected. The issue exists in the open‑webui:open‑webui product. Upgrading to 0.9.6 or newer applies the fix that validates redirect targets.

The CVSS score of 7.7 indicates high severity. The vulnerability is exploitable by any remote user who can instruct the application to fetch a URL, a capability typically exposed through normal functionality. The issue is not recorded in CISA KEV. The straightforward redirect trick makes the vulnerability comparatively easy to use. The absence of an EPSS score means the current exploitation probability is unknown, but the high severity and simple attack vector elevate the overall risk.