PT-2026-110707 · Git+1 · Open-Webui
CVSS v4.0
8.4
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions 0.11.1 through 0.11.3
Description
Authenticated users can execute scripts by uploading crafted DOCX attachments. The issue resides in
DocxPreview.svelte and occurs when attackers embed an OOXML altChunk HTML part or a script-scheme hyperlink. This allows the theft of a previewing administrator's session token from local storage, potentially leading to a full instance takeover.Recommendations
Update Open WebUI to version 0.11.4 or later.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Open-Webui