Open WebUI: Stored XSS to Account Takeover via Model Profile Images
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
- Record
- CVE-2026-54013
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- July 20, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no validate_profile_image_url field validator, and the model image serving endpoint has no MIME allowlist or nosniff header. Any authenticated user with workspace.models permission (enabled by default) can store a data:image/svg+xml;base64,... payload in a model's profile image and achieve full account takeover of anyone who navigates to the image URL. This vulnerability is fixed in 0.9.6.
Description quoted from the NVD record.
Who is affected
This flaw affects Open WebUI, a chat program for AI language models that organizations run on their own computers. It affects all versions before 0.9.6. The problem is in the profile pictures that can be set for AI models inside the product. Any signed-in user who is allowed to manage models in the workspace (allowed by default) can hide harmful code in a model's profile picture. Anyone who then opens the address of that picture can have their account fully taken over by that user. This flaw is rated High.
What to do
- Find out who looks after Open WebUI for your organization. If you or someone on your staff installed it and runs it, that person should act on this advisory.
- That person should update Open WebUI to version
0.9.6or later, which fixes this flaw. Every copy of Open WebUI your organization runs needs this update. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to version
0.9.6will be done.
Analysis written from the source record as of July 20, 2026 and reviewed before publishing.