Stored Cross-Site Scripting Vulnerability in Open-WebUI by Open-WebUI

CVE-2024-7044

Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of Open-WebUI version 0.3.8. This security flaw allows an attacker to inject malicious code into uploaded files. When these files are accessed by victims via shared chat URLs, the embedded JavaScript executes within the victims' browsers, potentially leading to severe consequences such as data theft, unauthorized account access, and phishing attempts. It is crucial for users of Open-WebUI to address this vulnerability to safeguard their systems against potential threats.

References