Stored Cross-Site Scripting Vulnerability in Open-WebUI by Open-WebUI
CVE-2024-7044

8.9HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui/open-webui
Vendor
CVE Published:
20 March 2025

What is CVE-2024-7044?

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of Open-WebUI version 0.3.8. This security flaw allows an attacker to inject malicious code into uploaded files. When these files are accessed by victims via shared chat URLs, the embedded JavaScript executes within the victims' browsers, potentially leading to severe consequences such as data theft, unauthorized account access, and phishing attempts. It is crucial for users of Open-WebUI to address this vulnerability to safeguard their systems against potential threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

open-webui/open-webui <= unspecified

References

https://huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bc...

CVSS V3.1

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

CVSS V3.0

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.