Skip to content
Threat Feed
Subscribe

Tag

Cve-2026-45315

1 brief RSS
high advisory

Open WebUI Stored XSS Vulnerability via Audio Transcription Endpoint (CVE-2026-45315)

Open WebUI is vulnerable to stored XSS via an attacker-controlled file extension in the /api/v1/audio/transcriptions endpoint (CVE-2026-45315), allowing a verified user with the chat.stt permission to upload a polyglot WAV+HTML file, tricking other users into executing arbitrary script code within the Open WebUI origin, leading to session token theft and full account takeover.

open-webui xss stored xss open webui cve-2026-45315
2r 2t 1c