Open WebUI versions 0.9.6 through 0.10.x allow an authenticated user to supply a page that is fetched with the Playwright engine. While the top‑level request is validated, sub‑resource requests are not, giving the rendered page JavaScript access to any internal address. The resulting SSRF can expose internal services, read sensitive data, and leak that data into web‑search or RAG outputs. This flaw is a classic CWE‑918 type SSRF that can lead to data exfiltration and potentially privilege escalation if internal services are misconfigured.

The vulnerability affects the open-webui product from version 0.9.6 up to, but excluding, 0.11.0. Any deployment using the environment variable WEB_LOADER_ENGINE=playwright within that range is impacted.

The CVSS score of 7.7 indicates a high impact if exploited. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no publicly known exploitation. The necessary conditions are an authenticated user with the ability to provide a custom page and a configuration that enables the Playwright loader. An attacker could therefore target an internal network from a compromised instance.