CVE-2026-45315

Katalog CVE

CVSS 8.7 · High EPSS 0,19%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada openwebui open webui. Skor CVSS 3.1 8.7 (High) menurut github.com.

Deskripsi (NVD)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHE_DIR/audio/transcriptions/.. The /cache/{path} route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no Content-Disposition. A verified user with the default-on chat.stt permission can upload a polyglot WAV+HTML file named pwn.html and trick any other user into opening the resulting URL — the response comes back as text/html and any embedded <script> runs in the Open WebUI origin. This vulnerability is fixed in 0.9.3.

Rincian

Terbit di NVD

15 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.7 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-434: Unrestricted Upload of File with Dangerous Type
CWE-646: Reliance on File Name or Extension of Externally-Supplied File

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 8,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-webui/open-webui/security/advisories/GHSA-m8f9-9whg-f4xr exploit · mitigasi · advisory vendor