Open WebUI Stored XSS Vulnerability via Audio Transcription Endpoint (CVE-2026-45315)

Open WebUI version 0.9.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability resides in the /api/v1/audio/transcriptions endpoint, which allows users to upload audio files for transcription. An attacker with a verified account and the default-enabled chat.stt permission can upload a specially crafted file disguised as audio but containing malicious HTML and JavaScript code. The server saves the file with an extension derived directly from the user-supplied filename without proper validation, enabling the stored XSS.

Attack Chain

1. An attacker with a verified user account authenticates to the Open WebUI instance.
2. The attacker crafts a polyglot WAV+HTML file, containing both valid WAV audio data and embedded JavaScript code designed for XSS.
3. The attacker uploads the malicious file to the /api/v1/audio/transcriptions endpoint, naming the file with an .html extension (e.g., pwn.html).
4. The server saves the file to the CACHE_DIR/audio/transcriptions/ directory, using the attacker-supplied .html extension.
5. The server generates a unique identifier (UUID) for the file and constructs the final file path using the UUID and the attacker-supplied extension.
6. A victim user clicks a link to the cached file served by the /cache/{path} route (e.g., /cache/audio/transcriptions/<uuid>.html).
7. The server serves the file with a Content-Type: text/html header based on the .html extension.
8. The victim's browser executes the embedded JavaScript code in the context of the Open WebUI origin, allowing the attacker to steal sensitive information, such as the JWT token stored in localStorage, leading to account takeover.

Impact

This stored XSS vulnerability (CVE-2026-45315) allows an attacker to execute arbitrary JavaScript code within the Open WebUI application on behalf of a victim user. An attacker can steal the victim's session token (JWT), which is stored in localStorage, and the OAuth token cookie is non-HttpOnly, gaining complete control over the victim's account. This includes the ability to view sensitive data, modify settings, and perform actions as the compromised user. Exploitation requires only a single click by the victim.

Recommendation

• Apply the patch or upgrade to a version of Open WebUI greater than 0.9.2 to remediate CVE-2026-45315.
• Implement strict validation of file extensions and MIME types on the /api/v1/audio/transcriptions endpoint to prevent uploading of malicious files.
• Configure the /cache/{path} route to force Content-Disposition: attachment and X-Content-Type-Options: nosniff to prevent the browser from interpreting files based on their content.
• Move the JWT token to an HttpOnly cookie to prevent JavaScript code from accessing it.
• Set the SameSite attribute for the OAuth token cookie to Lax to mitigate cross-site request forgery (CSRF) attacks.
• As a workaround, set USER_PERMISSIONS_CHAT_STT=False to revoke upload rights from non-administrators.