●PocketClawAI security alerts
Sign in
highCVSS 8.7NVD status: Modified

CVE-2026-45315

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.

ComponentOpen WebUI
Severityhigh (CVSS 8.7)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Published (NVD)2026-05-15
Last modified2026-06-17
Affected versions
open_webui < 0.9.3
Fixed in0.9.3
WeaknessCWE-79CWE-434CWE-646
CISA KEVnot listed

NVD description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHE_DIR/audio/transcriptions/.. The /cache/{path} route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no Content-Disposition. A verified user with the default-on chat.stt permission can upload a polyglot WAV+HTML file named pwn.html and trick any other user into opening the resulting URL — the response comes back as text/html and any embedded <script> runs in the Open WebUI origin. This vulnerability is fixed in 0.9.3.

Does CVE-2026-45315 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Open WebUI.
Check my stack

What to do

  • Upgrade Open WebUI to 0.9.3 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other Open WebUI CVEs

medium
CVE-2026-109288CVSS 6.4

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link UR...

Open WebUI
2026-10-12medium
CVE-2026-109284CVSS 4.3

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in...

Open WebUI
2026-10-12medium
CVE-2026-109283CVSS 5.4

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only fro...

Open WebUI
2026-10-12high
CVE-2026-109286CVSS 8.1

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to stea...

Open WebUI
2026-10-12medium
CVE-2026-109285CVSS 5

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base...

Open WebUI
2026-10-12medium
CVE-2026-109287CVSS 4.3

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir...

Open WebUI
2026-10-12

All Open WebUI CVEs