Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Open WebUI

CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

mediumCVSS 3.0 6.8GHSA-j274-m559-cj4j

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

Published Mar 20, 2025 · Updated Mar 21, 2025

Affected packages

open-webui

Ecosystem
PyPI
Affected
<= 0.3.8
Fixed in
No patched version yet
Check
pip show open-webui

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Open WebUI vulnerabilities

All Open WebUI entries