PT-2026-39266 · Unknown · Open-Webui

Published 2026-05-08 · Updated 2026-05-16 · CVE-2026-44549

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.8.0

Description Excel file attachments are previewed unsafely. A crafted XLSX file can cause the sheet to html() function to embed a Cross-Site Scripting (XSS) payload into the generated HTML. This content is then added to the Document Object Model (DOM) without sanitization via @html, allowing the payload to execute. The issue stems from a lack of input validation or sanitization for the HTML generated during the conversion of XLSX documents for preview, specifically involving the excelHtml variable.

Recommendations Update to version 0.8.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-44549

GHSA-JWF8-PV5P-VHMC

Affected Products

Open-Webui

References · 8

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-jwf8-pv5p-vhmc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44549 · Security Note
• https://osv.dev/vulnerability/GHSA-jwf8-pv5p-vhmc · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://t.me/cveNotify/163696 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2055503121497879015 · Twitter Post
• https://t.me/CVEtracker/53980 · Telegram Post
• https://twitter.com/CVEnew/status/2055457483573907652 · Twitter Post