Open WebUI versions up to 0.7.2 contain a blind Server Side Request Forgery (SSRF) vulnerability in the image editing functionality. The vulnerable function performs an asynchronous GET request on a user-supplied URL without restricting the domain, allowing interaction with local network addresses. Because the SSRF is blind, attackers cannot see the response but can infer open ports on the local network by detecting request failures. This enables port scanning of the local network and potentially interacting with services that accept state-changing GET requests.