Get all your news in one place.
100's of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

This WebUI vulnerability allows remote code execution - here's how to stay safe

AI writer.
  • Open WebUI carried CVE-2025-64496, a high-severity code injection flaw in Direct Connection features
  • Exploitation could enable account takeover and RCE via malicious model URLs and Functions API chaining
  • Patch v0.6.35 adds middleware protections; users urged to restrict Direct Connections and monitor tool permissions

Open WebUI, an open-source, self-hosted web interface for interacting with local or remote AI language models, carried a high-severity vulnerability that enabled account takeover and, in some cases, remote code execution (RCE), as well.

Sign up to read this article
Read news from 100's of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.