Executive brief
Open WebUI is a self-hosted platform for running artificial intelligence models offline. A security flaw allows users to upload malicious image files to AI model profiles that can execute code in the browsers of other users. If an administrator or another user views the malicious image, an attacker can steal their login session, leading to full account takeover and access to sensitive AI data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Open WebUI's model profile image handling. While previous patches addressed SVG XSS in user and webhook profiles, the ModelMeta class and the '/api/v1/models/model/profile/image' endpoint lacked similar validation. Specifically, the ModelMeta class lacks a 'validate_profile_image_url' field validator, and the image serving endpoint fails to implement a MIME allowlist or the 'X-Content-Type-Options: nosniff' header. An authenticated attacker with 'workspace.models' permissions (enabled by default) can upload a base64-encoded SVG containing a malicious script. When a victim views the image URL directly, the script executes in the context of the application's origin, allowing the attacker to access the victim's JWT from localStorage. This issue is resolved in version 0.9.6.
Affected products
- open-webui open-webui < 0.9.6
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date