XSS Vulnerability in Open WebUI Affects User Profile Images
CVE-2026-54013

7.6HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
23 June 2026

What is CVE-2026-54013?

Open WebUI, a self-hosted artificial intelligence platform, has a significant vulnerability that affects its ability to securely manage user profile images. In versions prior to 0.9.6, the application failed to implement proper validation for model profile images, which can allow an attacker to upload malicious SVG payloads. This vulnerability enables authenticated users with specific permissions to exploit the flaw, leading to full account takeover by redirecting users to compromised image URLs. The issue has been addressed in version 0.9.6, underscoring the importance of keeping software up to date.

Affected Version(s)

open-webui < 0.9.6

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.