PT-2026-60119 · Openwebui · Open-Webui

Matte1782 · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-56398

NVD

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-56398

Produtos afetados

Open-Webui

Referências · 3

• https://github.com/open-webui/open-webui/security/advisories/GHSA-3wgj-c2hg-vm6q · Aviso do Fabricante
• https://vulncheck.com/advisories/open-webui-stored-cross-site-scripting-via-oauth-picture-claim-svg-data-uri · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56398 · Nota de Segurança