PT-2026-39266 · Unknown · Open-Webui

CVE-2026-44549 · Published 2026-05-05 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.0

Description Excel file attachments are previewed unsafely. A crafted XLSX file can cause the sheet to html() function to embed a Cross-Site Scripting (XSS) payload into the generated HTML. This content is then added to the Document Object Model (DOM) without sanitization via @html, allowing the payload to execute. The issue stems from a lack of input validation or sanitization for the HTML generated during the conversion of XLSX documents for preview, specifically involving the excelHtml variable.

Recommendations Update to version 0.8.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-09669

CVE-2026-44549

GHSA-JWF8-PV5P-VHMC

PYSEC-2026-2744

Affected Products

Open-Webui

References · 14

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-jwf8-pv5p-vhmc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44549.json · Exploit
• https://osv.dev/vulnerability/GHSA-jwf8-pv5p-vhmc · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09669 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2744 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44549 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44549 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/VulmonFeeds/status/2055503121497879015 · Twitter Post
• https://t.me/CVEtracker/53980 · Telegram Post
• https://pypi.org/project/open-webui · Note
• https://github.com/advisories/GHSA-jwf8-pv5p-vhmc · Note
• https://t.me/cveNotify/163696 · Telegram Post
• https://twitter.com/CVEnew/status/2055457483573907652 · Twitter Post