open-webui vulnerabilities and threats

Open WebUI versions prior to 0.8.0 contain a cross-site scripting (XSS) vulnerability related to unsafe previewing of Excel file attachments. A crafted XLSX file can exploit the sheetjs function sheet_to_html to inject malicious HTML into the DOM without sanitization, leading to XSS. This vulnerability is fixed in version 0.8.0.

A cross-site scripting (XSS) vulnerability exists in open-webui versions prior to 0.8.0. The issue arises because the profile_image_url field on the user profile update form accepted arbitrary data URI values without MIME-type validation. This flaw was fixed in version 0.8.0.

Open WebUI versions prior to 0.8.0 contain a stored Cross-Site Scripting (XSS) vulnerability in the Banner component due to improper sanitization order. This flaw allows a malicious or compromised administrator to inject a payload into the global banner, which is rendered for all users including the Super Admin. The vulnerability enables privilege escalation by bypassing security mechanisms and stealing the Super Admin's session token. The issue is fixed in version 0.8.0.

Open WebUI versions prior to 0.8.0 have a missing authorization vulnerability in the GET /api/v1/memories/ef endpoint. This endpoint can be accessed without authentication and triggers embedding generation via a function call. If a paid embedding provider is used, this can lead to direct cost exposure. The issue is fixed in version 0.8.0.

Open WebUI versions prior to 0.6.10 contain a path traversal vulnerability in the audio file upload functionality. The filename from the HTTP upload request is not validated or sanitized, allowing attackers to use dot-segments to traverse directories and write files outside the intended upload directory. This can lead to arbitrary file uploads anywhere on the filesystem accessible by the web server user. The issue is fixed in version 0.6.10.

Open WebUI versions prior to 0.9.3 contain a vulnerability in the channel webhook create/update flow that allows arbitrary SVG images with embedded script handlers to be served without sanitization. This improper neutralization of alternate XSS syntax (CWE-87) enables attacker-controlled scripts to execute when the profile image URL is opened in a browser. The issue is fixed in version 0.9.3.

Open WebUI versions prior to 0.9.3 contain an authorization flaw where the POST /api/v1/notes/{id}/pin endpoint allows users with only read permissions to perform a write operation by toggling the is_pinned field. This improper permission check enables read-only users to pin or unpin shared notes, an action that should require write permission. The issue is resolved in version 0.9.3.

Open WebUI versions prior to 0.9.3 contain a Cross-Site Request Forgery (CSRF) vulnerability in the image uploading feature. This flaw allows authenticated users to set an image URL pointing to a malicious endpoint, causing any user who views the image to unknowingly send a GET request to the attacker-controlled URL. Exploitation can lead to cookie theft, denial of service, or other malicious actions. The vulnerability is fixed in version 0.9.3.

CVE-2026-45318 is a cross-site scripting (XSS) vulnerability in open-webui, a self-hosted AI platform. The issue arises from the XLSX.utils.sheet_to_html() function output being rendered without proper sanitization, allowing injection of malicious scripts. This vulnerability is a regression of a previous XSS flaw (CVE-2026-44549) and affects versions prior to 0.9.3. The vulnerability has been fixed in version 0.9.3.

CVE-2026-45315 is a high-severity cross-site scripting (XSS) vulnerability in open-webui versions prior to 0.9.3. The issue arises from the audio transcription upload endpoint, which saves files using the user-supplied filename extension without proper validation. This allows a verified user with chat.stt permission to upload a malicious polyglot WAV+HTML file that executes arbitrary scripts in the context of the Open WebUI origin when accessed by other users. The vulnerability is fixed in version 0.9.3.

Open WebUI versions prior to 0.8.6 contain a missing authorization vulnerability (CWE-862) in the message update endpoint. In standard channels, users with only read permission can update messages when access_control is set to None, allowing unauthorized modification of other users' messages. This issue is fixed in version 0.8.6.

Open WebUI versions prior to 0.8.6 contain a missing authorization vulnerability in the chat completion API. This flaw allows attackers to bypass tool restrictions by supplying arbitrary tool_ids or tool_servers parameters, enabling unauthorized invocation of server tools with elevated privileges. The vulnerability is fixed in version 0.8.6.

CVE-2026-45303 is a high-severity cross-site scripting (XSS) vulnerability in open-webui versions prior to 0.6.5. The vulnerability arises from the HTML rendering view that allows script injection and execution within a sandboxed iframe. However, the sandbox attributes permit script execution and access to the parent context's data, effectively nullifying sandbox protections. This flaw is fixed in version 0.6.5.

Open WebUI versions prior to 0.3.16 contain an improper access control vulnerability that allows any authenticated user to list, access, and delete files uploaded by all users. This issue is resolved in version 0.3.16.

CVE-2026-45345 is an improper authorization vulnerability in open-webui versions prior to 0.5.7. It allows a user with limited privileges to modify another user's AI model even if the model's visibility is set to Private by changing access permissions during editing. This issue is fixed in version 0.5.7.

Open WebUI versions prior to 0.6.31 contain a Cross-Site Scripting (XSS) vulnerability in the SVG renderer implementation. This vulnerability allows improper neutralization of script-related HTML tags, which could lead to script injection attacks. The issue is fixed in version 0.6.31.

Open WebUI versions prior to 0.5.11 contain a blind server-side request forgery (SSRF) vulnerability in the PDF generation function. This occurs because user inputs are interpreted as HTML and embedded into the PDF. Although scripts and certain dangerous tags are blocked, the image tag can be exploited to trigger server-side requests. This vulnerability is fixed in version 0.5.11.

CVE-2026-45351 is a vulnerability in open-webui versions prior to 0.8.9 where non-admin users could access sensitive system prompt information of AI models via a specific API request. This exposure affects the confidentiality of the application. The issue is resolved in version 0.8.9.

Open WebUI versions prior to 0.8.11 have an authorization bypass vulnerability in the /api/v1/notes/{note_id} endpoint. Authenticated users can access notes belonging to other users by guessing or enumerating note UUIDs, leading to unauthorized disclosure of sensitive data. This issue is fixed in version 0.8.11.

CVE-2026-45365 is an improper authorization vulnerability in open-webui versions prior to 0.8.11. It allows any authenticated user to bypass model access control checks by appending a query parameter to specific HTTP endpoints, enabling invocation of admin-restricted AI models. The issue is fixed in version 0.8.11.