CVE-2026-45303— Open WebUI: Stored XSS via the HTML renedering view
Possible ATT&CK Techniques 3AI
T1014 · Rootkit T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| open-webui | open-webui | < 0.6.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45303
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Open WebUI: Stored XSS via the HTML renedering view
Source: NVD (National Vulnerability Database)
Vulnerability Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.5, through the HTML rendering view, scripts can be injected and executed. The frontend provides a function to visualize the HTML content of a current chat. The content is embedded in an iFrame with the allow-scripts allow-forms allow-same-origin sandbox directive. This means that the content is placed in a sandbox but with permission to execute scripts and access the parent’s data (e.g., local storage). As a result, only a few functions are restricted (e.g., displaying an alert box), but in effect, the sandbox attribute is largely nullified. This vulnerability is fixed in 0.6.5.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-webui | open-webui | < 0.6.5 | - |
II. Public POCs for CVE-2026-45303
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45303
请登录查看更多情报信息。
Same Patch Batch · open-webui · 2026-05-15 · 59 CVEs total
| CVE-2026-44551 | 9.1 CRITICAL | Open WebUI: LDAP Empty Password Authentication Bypass |
| CVE-2026-45672 | 8.8 HIGH | Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature g |
| CVE-2026-45315 | 8.7 HIGH | Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcripti |
| CVE-2026-44552 | 8.7 HIGH | Open WebUI: Redis Cache Keys tool_servers and terminal_servers Missing Instance Prefix Ena |
| CVE-2026-45331 | 8.5 HIGH | Open WebUI: Full SSRF Vulnerability in the RAG Web Search Feature |
| CVE-2026-45400 | 8.5 HIGH | Open WebUI: Server-Side Request Forgery (SSRF) bypass in `validate_url` |
| CVE-2026-45401 | 8.5 HIGH | Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints |
| CVE-2026-44570 | 8.3 HIGH | Open WebUI: Inconsistent authorization controls within memories API |
| CVE-2026-44565 | 8.1 HIGH | Open WebUI: Open WebUI Arbitrary File Write, Delete via Path Traversal |
| CVE-2026-45675 | 8.1 HIGH | Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts |
| CVE-2026-44553 | 8.1 HIGH | Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User No |
| CVE-2026-44554 | 8.1 HIGH | Open WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overw |
| CVE-2026-45301 | 8.1 HIGH | Open WebUI: Missing permission check in files API allows authenticated users to list, acce |
| CVE-2026-45665 | 8.1 HIGH | Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order |
| CVE-2026-45402 | 8.1 HIGH | Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge |
| CVE-2026-45671 | 8.0 HIGH | Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion |
| CVE-2026-45338 | 7.7 HIGH | Open WebUI: SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py) |
| CVE-2026-44555 | 7.6 HIGH | Open WebUI: Base Model Routing Bypasses Access Control via Model Chaining |
| CVE-2026-45398 | 7.5 HIGH | Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls |
| CVE-2026-44566 | 7.3 HIGH | Open WebUI: Arbitrary File Upload and Path Traversal |
Showing top 20 of 59 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: open-webui
- CVE-2026-45338
Open WebUI: SSRF via OAuth Profile Picture URL in _process_p - CVE-2026-44549
Open WebUI: Stored XSS in excel file preview - CVE-2026-45299
Open WebUI: Stored Cross-Site Scripting In Profile Picture - CVE-2026-45665
Open WebUI: Stored XSS in Banner Component via Improper Sani - CVE-2026-45667
Open WebUI: Unauthenticated endpoint can trigger embedding g
Same vendor: open-webui
- CVE-2026-45338
Open WebUI: SSRF via OAuth Profile Picture URL in _process_p - CVE-2026-44549
Open WebUI: Stored XSS in excel file preview - CVE-2026-45299
Open WebUI: Stored Cross-Site Scripting In Profile Picture - CVE-2026-45665
Open WebUI: Stored XSS in Banner Component via Improper Sani - CVE-2026-45667
Open WebUI: Unauthenticated endpoint can trigger embedding g
Same weakness: CWE-79
- CVE-2026-8656
jsondiffpatch < 0.7.6 格式化器跨站脚本漏洞 - CVE-2026-44549
Open WebUI: Stored XSS in excel file preview - CVE-2026-45299
Open WebUI: Stored Cross-Site Scripting In Profile Picture - CVE-2026-45665
Open WebUI: Stored XSS in Banner Component via Improper Sani - CVE-2026-45318
Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX fil
V. Comments for CVE-2026-45303
No comments yet