Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-7044US | high8.9 | — | ||
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-j274-m559-cj4jADVISORY
- https://github.com/open-webui/open-webuiPACKAGE
- https://github.com/open-webui/open-webui/commit/0da0e12096cc771ce4359c163e03c5a754d95c5eFIX
- https://huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-7044ADVISORY
- https://pypi.org/project/open-webuiPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan