PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45314 open-webui CVE debrief

Open WebUI versions prior to 0.9.3 contain a stored cross-site scripting vulnerability in the channel webhook profile image functionality. The application accepts arbitrary profile_image_url values, including data:image/svg+xml;base64 payloads, and serves these without sanitization as image/svg+xml content. When a user opens a profile image URL containing malicious SVG with script handlers such as onload, attacker-controlled JavaScript executes in the victim's browser context. This requires low privileges and user interaction, with high impact to confidentiality and integrity of the affected session. The vulnerability was disclosed via GitHub Security Advisory and patched in version 0.9.3.

Vendor
open-webui
Product
Unknown
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-18
Advisory published
2026-05-15
Advisory updated
2026-05-18

Who should care

Organizations running self-hosted Open WebUI instances prior to 0.9.3, particularly those with multi-user deployments where channel webhooks are accessible to non-administrative users. Security teams should prioritize patching due to the high confidentiality and integrity impact combined with relatively low exploitation complexity.

Technical summary

The vulnerability exists in the channel webhook create and update flow where profile_image_url parameters accept arbitrary values without validation. The endpoint decodes base64-encoded SVG content and serves it with image/svg+xml MIME type, preserving embedded script handlers. Attackers with low-privilege access can create or modify webhooks to inject malicious SVG payloads that execute when rendered in victim browsers. The fix in version 0.9.3 implements proper sanitization of profile image content.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Open WebUI to version 0.9.3 or later
  • Review existing channel webhooks for suspicious profile_image_url values containing data:image/svg+xml or script handlers
  • Implement Content Security Policy headers to mitigate impact of injected scripts
  • Validate and sanitize all user-supplied image URLs, rejecting data URIs with executable content
  • Audit access logs for unexpected requests to profile image endpoints with base64-encoded SVG payloads

Evidence notes

Vendor advisory confirms SVG payload execution via profile_image_url in channel webhooks. CVSS 4.0 vector indicates network attack vector, low attack complexity, privileged access required, user interaction required, high confidentiality and integrity impact. CWE-87 (Improper Neutralization of Alternate XSS Syntax) cited as secondary weakness.

Official resources

2026-05-15