CVE-2026-45315
HighSummary
Open WebUI prior to version 0.9.3 has a vulnerability that allows audio files with HTML extensions to be uploaded, potentially leading to the execution of malicious code in users' browsers. A user with the appropriate permissions can trick others into opening a malicious link.
Risk Assessment
This vulnerability poses a risk of executing malicious code in the browser context, which could lead to data theft or session hijacking. Organizations should be aware of potential attacks on their users.
Recommendation
It is recommended to update Open WebUI to version 0.9.3 or later to mitigate this vulnerability. Additionally, implementing further security checks on file uploads is advisable.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHE_DIR/audio/transcriptions/.. The /cache/{path} route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no Content-Disposition. A verified user with the default-on chat.stt permission can upload a polyglot WAV+HTML file named pwn.html and trick any other user into opening the resulting URL — the response comes back as text/html and any embedded <script> runs in the Open WebUI origin. This vulnerability is fixed in 0.9.3.