CVE-2026-45299: Open WebUI XSS Vulnerability

CVE-2026-45299 Overview

CVE-2026-45299 is a stored cross-site scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The profile_image_url field on the user profile update form accepted arbitrary data: URI values without MIME-type validation. An authenticated attacker can submit a crafted data: URI containing executable script content, which other users render when viewing the affected profile. The flaw is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation. The issue is fixed in Open WebUI version 0.8.0.

Critical Impact
An authenticated attacker can store JavaScript payloads inside a user profile and execute them in the browser context of any user who views the profile, enabling session theft and unauthorized actions in the Open WebUI application.

Affected Products

Open WebUI versions prior to 0.8.0
Self-hosted Open WebUI deployments exposing user profile functionality
Multi-tenant Open WebUI instances where users can view other users' profile images

Discovery Timeline

2026-05-15 - CVE-2026-45299 published to the National Vulnerability Database (NVD)
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45299

Vulnerability Analysis

The vulnerability resides in the user profile update form, which exposes a profile_image_url field. The application accepted any string conforming to the data: URI scheme without validating the declared MIME type. An attacker can supply a payload such as data:text/html;base64,<encoded HTML and script> instead of an expected image MIME type like image/png or image/jpeg. When the frontend later renders the profile image reference in a context that interprets HTML or script, the attacker-controlled payload executes in the victim's browser session.

Because Open WebUI is an AI platform, users frequently interact with chats, model configurations, and shared resources. Script execution in that context can exfiltrate session tokens, manipulate model settings, or pivot to attached integrations.

Root Cause

The root cause is missing input validation on the profile_image_url field. The server-side handler accepted any data: URI without enforcing an allowlist of image MIME types such as image/png, image/jpeg, image/gif, or image/webp. The client-side rendering path also did not enforce a safe rendering contract for the field, allowing scriptable content to be embedded.

Attack Vector

Exploitation requires an authenticated user account and user interaction from a victim viewing the malicious profile. The attacker updates their profile image to a data:text/html or data:image/svg+xml URI containing a script payload. When another user navigates to a view that renders the attacker's profile, the payload executes under the Open WebUI origin. The scope is changed because script execution in the victim's browser context affects resources beyond the attacker's own account.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-6gh2-q7cp-9qf6 for vendor-provided technical details.

Detection Methods for CVE-2026-45299

Indicators of Compromise

User profile records where the profile_image_url field contains a data: URI with a non-image MIME type such as data:text/html, data:application/javascript, or data:image/svg+xml containing <script> elements.
HTTP requests to the profile update endpoint with oversized or base64-encoded profile_image_url payloads inconsistent with normal image data.
Outbound browser requests from authenticated Open WebUI sessions to unexpected external domains shortly after viewing another user's profile.

Detection Strategies

Query the Open WebUI user database for any profile_image_url value not beginning with data:image/ followed by a valid image subtype, or not matching the expected URL pattern for hosted images.
Inspect web server and reverse proxy logs for PUT or POST requests to profile update endpoints containing data:text/html or data:image/svg+xml substrings.
Use Content Security Policy (CSP) violation reports to surface unexpected inline script execution originating from rendered profile content.

Monitoring Recommendations

Enable verbose application logging for profile update operations and forward logs to a centralized SIEM for retention and analysis.
Monitor for anomalous session activity such as token reuse across IP addresses, which can indicate stolen credentials following XSS exploitation.
Alert on user accounts that update the profile_image_url field with payloads exceeding a reasonable size threshold for embedded images.

How to Mitigate CVE-2026-45299

Immediate Actions Required

Upgrade Open WebUI to version 0.8.0 or later, where the profile_image_url field enforces MIME-type validation.
Audit all existing user profiles and remove or sanitize any profile_image_url values containing non-image data: URIs.
Force a password reset and session invalidation for accounts that may have viewed malicious profiles during the exposure window.

Patch Information

The vendor has released a fix in Open WebUI 0.8.0. The patch adds MIME-type validation to the profile_image_url field, rejecting data: URIs that do not declare an allowed image content type. See the Open WebUI Security Advisory GHSA-6gh2-q7cp-9qf6 for the official advisory and patch references.

Workarounds

Restrict account creation to trusted users and disable open registration until the upgrade is complete.
Deploy a reverse proxy rule that rejects profile update requests where the profile_image_url parameter contains data:text/, data:application/, or data:image/svg.
Enforce a strict Content Security Policy that disallows inline scripts and restricts img-src to trusted origins, limiting the impact of stored XSS payloads.

bash

# Example reverse proxy filter (NGINX) to block dangerous data: URIs in profile updates
location /api/v1/users/update {
    if ($request_body ~* "profile_image_url\"\s*:\s*\"data:(text|application|image/svg)") {
        return 400;
    }
    proxy_pass http://open_webui_backend;
}