{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/open-webui--0.9.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-45315"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["open-webui (\u003c= 0.9.2)"],"_cs_severities":["high"],"_cs_tags":["xss","stored xss","open webui","cve-2026-45315"],"_cs_type":"advisory","_cs_vendors":["Open WebUI"],"content_html":"\u003cp\u003eOpen WebUI version 0.9.2 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The vulnerability resides in the \u003ccode\u003e/api/v1/audio/transcriptions\u003c/code\u003e endpoint, which allows users to upload audio files for transcription. An attacker with a verified account and the default-enabled \u003ccode\u003echat.stt\u003c/code\u003e permission can upload a specially crafted file disguised as audio but containing malicious HTML and JavaScript code. The server saves the file with an extension derived directly from the user-supplied filename without proper validation, enabling the stored XSS.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker with a verified user account authenticates to the Open WebUI instance.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a polyglot WAV+HTML file, containing both valid WAV audio data and embedded JavaScript code designed for XSS.\u003c/li\u003e\n\u003cli\u003eThe attacker uploads the malicious file to the \u003ccode\u003e/api/v1/audio/transcriptions\u003c/code\u003e endpoint, naming the file with an \u003ccode\u003e.html\u003c/code\u003e extension (e.g., \u003ccode\u003epwn.html\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server saves the file to the \u003ccode\u003eCACHE_DIR/audio/transcriptions/\u003c/code\u003e directory, using the attacker-supplied \u003ccode\u003e.html\u003c/code\u003e extension.\u003c/li\u003e\n\u003cli\u003eThe server generates a unique identifier (UUID) for the file and constructs the final file path using the UUID and the attacker-supplied extension.\u003c/li\u003e\n\u003cli\u003eA victim user clicks a link to the cached file served by the \u003ccode\u003e/cache/{path}\u003c/code\u003e route (e.g., \u003ccode\u003e/cache/audio/transcriptions/\u0026lt;uuid\u0026gt;.html\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server serves the file with a \u003ccode\u003eContent-Type: text/html\u003c/code\u003e header based on the \u003ccode\u003e.html\u003c/code\u003e extension.\u003c/li\u003e\n\u003cli\u003eThe victim's browser executes the embedded JavaScript code in the context of the Open WebUI origin, allowing the attacker to steal sensitive information, such as the JWT token stored in \u003ccode\u003elocalStorage\u003c/code\u003e, leading to account takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis stored XSS vulnerability (CVE-2026-45315) allows an attacker to execute arbitrary JavaScript code within the Open WebUI application on behalf of a victim user. An attacker can steal the victim's session token (JWT), which is stored in \u003ccode\u003elocalStorage\u003c/code\u003e, and the OAuth token cookie is non-HttpOnly, gaining complete control over the victim's account. This includes the ability to view sensitive data, modify settings, and perform actions as the compromised user. Exploitation requires only a single click by the victim.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch or upgrade to a version of Open WebUI greater than 0.9.2 to remediate CVE-2026-45315.\u003c/li\u003e\n\u003cli\u003eImplement strict validation of file extensions and MIME types on the \u003ccode\u003e/api/v1/audio/transcriptions\u003c/code\u003e endpoint to prevent uploading of malicious files.\u003c/li\u003e\n\u003cli\u003eConfigure the \u003ccode\u003e/cache/{path}\u003c/code\u003e route to force \u003ccode\u003eContent-Disposition: attachment\u003c/code\u003e and \u003ccode\u003eX-Content-Type-Options: nosniff\u003c/code\u003e to prevent the browser from interpreting files based on their content.\u003c/li\u003e\n\u003cli\u003eMove the JWT token to an \u003ccode\u003eHttpOnly\u003c/code\u003e cookie to prevent JavaScript code from accessing it.\u003c/li\u003e\n\u003cli\u003eSet the \u003ccode\u003eSameSite\u003c/code\u003e attribute for the OAuth token cookie to \u003ccode\u003eLax\u003c/code\u003e to mitigate cross-site request forgery (CSRF) attacks.\u003c/li\u003e\n\u003cli\u003eAs a workaround, set \u003ccode\u003eUSER_PERMISSIONS_CHAT_STT=False\u003c/code\u003e to revoke upload rights from non-administrators.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-14T20:31:48Z","date_published":"2026-05-14T20:31:48Z","id":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-xss/","summary":"Open WebUI is vulnerable to stored XSS via an attacker-controlled file extension in the /api/v1/audio/transcriptions endpoint (CVE-2026-45315), allowing a verified user with the chat.stt permission to upload a polyglot WAV+HTML file, tricking other users into executing arbitrary script code within the Open WebUI origin, leading to session token theft and full account takeover.","title":"Open WebUI Stored XSS Vulnerability via Audio Transcription Endpoint (CVE-2026-45315)","url":"https://feed.craftedsignal.io/briefs/2026-05-open-webui-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Open-Webui (\u003c= 0.9.2)","version":"https://jsonfeed.org/version/1.1"}