{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-03T14:10:12.543","vulnerabilities":[{"cve":{"id":"CVE-2026-28786","sourceIdentifier":"security-advisories@github.com","published":"2026-03-27T00:16:22.503","lastModified":"2026-06-17T10:29:02.550","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a `FileNotFoundError` whose message — including the server's absolute `DATA_DIR` path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments. Version 0.8.6 patches the issue."},{"lang":"es","value":"Open WebUI es una plataforma de inteligencia artificial autoalojada diseñada para operar totalmente fuera de línea. Antes de la versión 0.8.6, un campo de nombre de archivo no saneado en el endpoint de transcripción de voz a texto permite a cualquier usuario autenticado no administrador activar un 'FileNotFoundError' cuyo mensaje — incluyendo la ruta absoluta 'DATA_DIR' del servidor — se devuelve textualmente en el cuerpo de la respuesta HTTP 400, confirmando la revelación de información en todas las implementaciones predeterminadas. La versión 0.8.6 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"open-webui","product":"open-webui","versions":[{"version":"< 0.8.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-27T13:27:12.139750Z","id":"CVE-2026-28786","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-209"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*","versionEndExcluding":"0.8.6","matchCriteriaId":"98042D01-E16B-45CE-9BBC-E5A6E2AA2370"}]}]}],"references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-vvxm-vxmr-624h","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-vvxm-vxmr-624h","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}