CVE-2026-109290 Overview
CVE-2026-109290 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting Open WebUI versions 0.11.1 through 0.11.3. The flaw resides in DocxPreview.svelte, which renders uploaded DOCX attachments without adequate sanitization. Authenticated users can craft a DOCX file containing an Office Open XML (OOXML) altChunk HTML part or a script-scheme hyperlink. When an administrator previews the attachment, the embedded payload executes in the admin's browser context. Attackers use this to steal the administrator's session token from local storage and take over the Open WebUI instance.
Critical Impact
Successful exploitation yields administrative account takeover of the Open WebUI instance through session token theft.
Affected Products
- Open WebUI 0.11.1
- Open WebUI 0.11.2
- Open WebUI 0.11.3
Discovery Timeline
- 2026-10-12 - CVE-2026-109290 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109290
Vulnerability Analysis
Open WebUI renders uploaded DOCX attachments through the DocxPreview.svelte component. The component processes OOXML content without stripping dangerous constructs before injecting the rendered HTML into the DOM. Two payload families trigger script execution in the preview context.
The first family abuses the OOXML altChunk element. altChunk allows a DOCX document to embed an alternative content part, including an HTML fragment. When the preview renderer expands the altChunk reference, embedded <script> tags and inline event handlers execute inside the previewing user's session.
The second family uses hyperlinks with script-scheme targets. The renderer preserves javascript: URLs in anchor elements. An administrator clicking a crafted link, or triggering an auto-executed event, runs attacker-controlled JavaScript.
Because Open WebUI stores session tokens in localStorage, the injected script reads the token directly and exfiltrates it to an attacker-controlled host. The attacker then replays the token to assume the administrator's identity.
Root Cause
The root cause is missing output sanitization in DocxPreview.svelte. The component trusts OOXML-derived HTML and does not filter altChunk HTML parts, event-handler attributes, or javascript: URI schemes before rendering.
Attack Vector
Exploitation requires an authenticated low-privilege user to upload a crafted DOCX file as a chat attachment. The payload activates when a higher-privileged user, such as an administrator, opens the attachment preview. User interaction is required on the victim side, matching the UI:A component of the CVSS vector.
See the GitHub Security Advisory GHSA-f9xp-mfmq-x6cg and the VulnCheck Advisory for XSS for additional technical context.
Detection Methods for CVE-2026-109290
Indicators of Compromise
- Uploaded DOCX files whose internal word/document.xml references w:altChunk elements pointing to text/html parts.
- DOCX relationship files (word/_rels/document.xml.rels) containing hyperlink targets with the javascript: scheme.
- Outbound requests from administrator browsers to unknown domains immediately after opening a chat attachment preview.
- Session reuse of an administrator's bearer token from a new IP address or user agent.
Detection Strategies
- Scan uploaded DOCX attachments server-side for altChunk references and javascript: hyperlink targets before storage.
- Monitor web proxy and browser telemetry for anomalous script-initiated requests originating from the Open WebUI origin.
- Correlate attachment upload events with subsequent administrative API calls from different sessions to detect token replay.
Monitoring Recommendations
- Enable application-level audit logging for file upload, preview, and admin API events in Open WebUI.
- Alert on administrator session tokens observed from more than one source IP within a short window.
- Review Content Security Policy (CSP) violation reports for inline script or javascript: URL blocks on the Open WebUI origin.
How to Mitigate CVE-2026-109290
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.4 or later, which contains the sanitization fix.
- Rotate all administrator session tokens and API keys following the upgrade.
- Audit stored chat attachments for DOCX files containing altChunk or javascript: constructs and quarantine suspicious uploads.
- Restrict file upload permissions to trusted users while patching is pending.
Patch Information
The maintainers released a fix in Open WebUI 0.11.4. Details are published in the GitHub Security Advisory GHSA-f9xp-mfmq-x6cg. Upgrading to 0.11.4 or later removes the exploitable rendering path in DocxPreview.svelte.
Workarounds
- Disable DOCX preview functionality until the upgrade is applied.
- Block DOCX uploads at a reverse proxy or web application firewall if preview cannot be disabled.
- Enforce a strict Content Security Policy that forbids inline scripts and javascript: URLs on the Open WebUI origin.
- Move session tokens out of localStorage into HttpOnly cookies where deployment architecture allows.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
