---
cve: "CVE-2025-64496"
severity: "HIGH"
cvss: 7.3
epss: "7.2%"
vendor: "open-webui"
kev: false
exploited: false
published: "2025-11-08 02:15:35"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T14:25:38+01:00"
---

# CVE-2025-64496

> 7.3 HIGH · 🧪 PoC

## Beschreibung

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2025-11-13 21:37:59
- CNA-CVSS: **7.3** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-501** — Trust Boundary Violation
  The product mixes trusted and untrusted data in the same data structure or structured message.
- **CWE-829** — Inclusion of Functionality from Untrusted Control Sphere
  The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
- **CWE-830** — Inclusion of Web Functionality from an Untrusted Source
  The product includes web functionality (such as a web widget) from another domain in a way that causes the functionality to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
- **CWE-95** — Improper Neutralization of Directives in Dynamically Evaluated Code
  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

## Patch verfügbar (OSV)

- e85c7f79310f351672fe967a102396b6f3f5e88b (Commit)
- 8af6a4cf21b756a66cd58378a01c60f74c39b7ca (Commit)

## Referenzen

- <https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx>
- <https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-64496/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_