Critical Unpatched XSS Flaw in Open WebUI Enables 1-Click RCE and Account Takeover Security researchers have disclosed a severe stored Cross-Site Scripting (XSS) vulnerability in Open WebUI, allowing attackers to achieve remote code execution (RCE) or full account hijacking with minimal user interaction. The flaw, discovered by researcher Metin Yunus Kandemir, stems from improper validation of profile image uploads, specifically when handling base64-encoded SVG files. ### How the Attack Works The vulnerability exploits Open WebUI’s backend routing, where the system fails to enforce strict file-type restrictions. Attackers can embed malicious JavaScript in an SVG file using the `data:image/svg+xml;base64` format. When uploaded as a profile picture, the server processes and renders the file inline, executing the embedded code in the victim’s browser. The attack chain unfolds in two scenarios: 1. Administrator/Privileged User Compromise – If the victim has elevated access, the payload silently calls Open WebUI’s API to create a malicious tool, injecting a reverse shell for full RCE. 2. Standard User Account Takeover – For non-privileged users, the payload extracts local storage tokens and chat logs, transmitting them to an attacker-controlled server. Key targeted API endpoints include: - `/api/v1/tools/create` (RCE payload delivery) - `/api/v1/chats/all` (chat history extraction) - `/api/v1/users/search` (user enumeration) - `/api/v1/users/[user_id]/profile/image` (malicious SVG execution) ### Disclosure and Current Status Researchers privately reported the issue to Open WebUI maintainers in March, but the report was closed as a duplicate of a non-public advisory, with no official acknowledgment. Frustrated by the lack of response, researchers publicly disclosed the flaw to warn users. As of version 0.7.2, the vulnerability remains unpatched. Until an official fix is released, organizations using Open WebUI are exposed to phishing-driven attacks, where a single click on a malicious link could trigger exploitation. The flaw is particularly dangerous in enterprise environments, where compromised admin accounts could lead to widespread system breaches.

High-Severity Vulnerability in Open WebUI Enables Account Takeover and RCE A high-severity code injection flaw, tracked as CVE-2025-64496 (CVSS 8.0), was discovered in Open WebUI, an open-source, self-hosted interface for AI language models. The vulnerability, disclosed in October 2025 by Cato CTRL Senior Security Researcher Vitaly Simonovich, affects versions 0.6.34 and earlier and resides in the Direct Connection feature. The flaw allows attackers to execute arbitrary JavaScript via Server-Sent Event (SSE) execute events, enabling account takeover through token theft. When chained with the Functions API, the exploit can escalate to remote code execution (RCE) on the backend server. Exploitation requires victims to enable Direct Connections (disabled by default) and add a malicious model URL, which can be achieved through social engineering. The patch, version 0.6.35, introduces middleware protections to block malicious SSE execution from Direct Connection servers. Researchers recommend restricting Direct Connections to vetted services, limiting workspace.tools permissions to essential users, and monitoring for suspicious tool creations. The vulnerability highlights a trust boundary failure between untrusted model servers and a trusted browser context.