Is CVE-2026-28786 actively exploited?

No active exploitation of CVE-2026-28786 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-28786 be exploited remotely?

Yes. CVE-2026-28786 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-28786?

CVE-2026-28786 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-28786

MEDIUM

CVE-2026-28786

CWE-22Published: March 27, 2026· Updated: Mar 30, 2026

4.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.3th

Official Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a `FileNotFoundError` whose message — including the server's absolute `DATA_DIR` path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments. Version 0.8.6 patches the issue.

NVD Source

Technical Analysis

CVE-2026-28786 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.