CVE-2026-70486

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.10.2

Description An issue exists where the terminal file-preview serveUrl iframe branch grants allow-same-origin and allow-scripts permissions for HTML files served from the application origin. This occurs when a terminal server is configured via TERMINAL SERVER CONNECTIONS and TERMINAL PROXY HEADERS is unset. An authenticated user can cause a script within a previewed file to execute in the Open WebUI origin by triggering a display file tool call. This allows the attacker to read the victim's session token from localStorage, leading to full account takeover. If the victim has administrator privileges or workspace.functions permissions, this can further result in server-side code execution through Functions. The vulnerability is located in the serveUrl path within the FilePreview.svelte component, specifically affecting files served through the /api/v1/terminals/{id}/files/serve/... endpoint.

Recommendations Update Open WebUI to version 0.11.0. As a temporary mitigation, ensure that TERMINAL PROXY HEADERS is configured with a restrictive Content-Security-Policy.