Open WebUI: Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 8.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- Record
- CVE-2026-45315
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHE_DIR/audio/transcriptions/.. The /cache/{path} route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no Content-Disposition. A verified user with the default-on chat.stt permission can upload a polyglot WAV+HTML file named pwn.html and trick any other user into opening the resulting URL — the response comes back as text/html and any embedded <script> runs in the Open WebUI origin. This vulnerability is fixed in 0.9.3.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted chat screen that lets people in your organization talk to AI models, built to run entirely offline. This flaw affects versions before 0.9.3 and sits in the voice-to-text feature that accepts audio uploads. Any verified user who can use voice-to-text, which is allowed by default, can upload a disguised file and then trick another user into opening a link to it. Hidden code in that file then runs inside Open WebUI in the other person's browser, as if Open WebUI itself sent it. This flaw is rated High.
What to do
- The person who installed or runs Open WebUI for your organization should handle this.
- If an IT provider or vendor runs Open WebUI for you, send them this advisory and ask when the update will be done.
- Update Open WebUI to version
0.9.3or later, which fixes this flaw. - Until the update is in place, remind staff that this attack depends on someone opening a link to a file another user uploaded, so they should be cautious about unexpected Open WebUI links shared by colleagues.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.