Stored Cross-Site Scripting in Open WebUI Prior to Version 0.11.4
CVE-2026-109290

8.4HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109290?

Open WebUI versions prior to 0.11.4 contain a stored cross-site scripting vulnerability in the DocxPreview.svelte component. Authenticated users can exploit this flaw by uploading specially crafted DOCX files that embed an OOXML altChunk HTML part or a script-scheme hyperlink. This can lead to the unauthorized execution of scripts, enabling attackers to steal session tokens from the local storage of administrators previewing the document, potentially allowing for a complete takeover of the affected web application instance.

Affected Version(s)

open-webui 0.11.1 < 0.11.4

open-webui 0.11.4

References

https://github.com/open-webui/open-webui/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/open-webui-0.11.1-be...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Observerkay
Classic298
.