PT-2026-59352 · Pypi · Open-Webui

Published

2026-07-13

·

Updated

2026-07-13

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

The profile image url field on the user profile update form accepted arbitrary data: URI values without MIME-type validation. Two distinct attack paths were independently demonstrated by separate reporters:
  1. data:text/html;base64,... in a new browser tab (raresvis, 2025-04-17) — when a victim right-clicks a user's profile picture and chooses "Open image in new tab", the browser navigates to the data: URL and executes embedded scripts in the data: origin. Limited to social-engineering / redirect attacks because the script does not run in the application origin.
  2. data:image/svg+xml;base64,... re-served by the application origin (Gh05t666nero, 2026-01-09) — GET /api/v1/users/{user id}/profile/image decoded the base64 and returned StreamingResponse(media type=<user-controlled>) extracted from the data: header. With media type=image/svg+xml and Content-Disposition: inline, the SVG-embedded scripts executed in the application origin, enabling JWT theft from localStorage and full account takeover of any user — including admins — who loaded the malicious profile image URL.
Both attack paths share the same root cause (lack of MIME-type validation on profile image url) and are closed by the same fix.

Vulnerable code (v0.7.0)

backend/open webui/routers/users.py get user profile image by id():
python
elif user.profile image url.startswith("data:image"):
  header, base64 data = user.profile image url.split(",", 1)
  image data = base64.b64decode(base64 data)
  image buffer = io.BytesIO(image data)
  media type = header.split(";")[0].lstrip("data:") # user-controlled
  return StreamingResponse(
    image buffer,
    media type=media type,
    headers={"Content-Disposition": "inline"},
  )

Fix

Commit 773787c74 (2026-02-11), first contained in tag v0.8.0, applies the validate profile image url field validator to every form that accepts profile image url (UserModel, UpdateProfileForm, SignupForm in backend/open webui/models/users.py and backend/open webui/models/auths.py). The validator explicitly rejects data:image/svg+xml and any non-image data URI, allowing only data:image/{png,jpeg,gif,webp};base64 plus known internal paths and http(s):// URLs. This blocks both attack vectors at form submission time, so a malicious URL can no longer be persisted to the database.

Credits

  • raresvis — discovered the data:text/html-via-new-tab path
  • Gh05t666nero — discovered the data:image/svg+xml-via-server-side path (the more severe origin-XSS vector that determined the consolidated CVSS)
Per our Report Handling policy, the cluster is consolidated into the earliest filing with credit to every reporter who demonstrated a distinct exploitation path.

Affected / patched versions

  • Affected: < 0.8.0
  • Patched: >= 0.8.0

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-2708

Affected Products

Open-Webui