PT-2026-50485 · Unknown · Open-Webui

0Xer3N · CVE-2026-54013 · Published 2026-06-17 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6

Description Open WebUI contains a stored Cross-Site Scripting (XSS) issue where the platform fails to validate profile images for models. While similar issues were patched for user and webhook profile images, the ModelMeta class lacks a validate profile image url field validator. Additionally, the model image serving endpoint does not implement a MIME allowlist or the X-Content-Type-Options: nosniff header. An authenticated user with workspace.models permissions can store a malicious data:image/svg+xml;base64,... payload in a model's profile image. If another user navigates to the image URL, the embedded script executes in the application's origin, potentially leading to full account takeover via token theft from local storage.

Technical details include:

• API Endpoints: '/api/v1/models/create', '/api/v1/models/update', '/api/v1/models/import', and the serving endpoint '/api/v1/models/model/profile/image'.
• Vulnerable Parameters: The profile image url variable within the ModelMeta class.

Recommendations Update to version 0.9.6. As a temporary workaround, restrict the workspace.models permission to trusted administrators to prevent unauthorized users from uploading malicious model profile images.

Exploit

Fix

Protection Mechanism Failure

XSS

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-693

CWE-79

CWE-116

Related Identifiers

CVE-2026-54013

GHSA-V2QM-5WXJ-QHJ7

PYSEC-2026-2757

Affected Products

Open-Webui

References · 13

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-v2qm-5wxj-qhj7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54013.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54013 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2757 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-54013 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v2qm-5wxj-qhj7 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2757.yaml · Note
• https://t.me/cveNotify/175055 · Telegram Post
• https://pypi.org/project/open-webui · Note
• https://t.me/cveNotify/177618 · Telegram Post
• https://github.com/advisories/GHSA-v2qm-5wxj-qhj7 · Note
• https://twitter.com/VulmonFeeds/status/2069525362057314602 · Twitter Post