CVE-2026-54013 Details
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no validate_profile_image_url field validator, and the model image serving endpoint has no MIME allowlist or nosniff header. Any authenticated user with workspace.models permission (enabled by default) can store a data:image/svg+xml;base64,... payload in a model's profile image and achieve full account takeover of anyone who navigates to the image URL. This vulnerability is fixed in 0.9.6.
A stored cross-site scripting vulnerability has been identified in Open WebUI versions prior to 0.9.6. The issue arises in the ModelMeta class, which lacks a validator for profile image URLs. This oversight allows authenticated users with workspace.models permission to inject malicious SVG images that execute scripts, leading to account takeover. The vulnerability exists because the model image serving endpoint does not validate MIME types or include a nosniff header, enabling the execution of embedded scripts in the SVG.
Users are advised to update to Open WebUI version 0.9.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-v2qm-5wxj-qhj7 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-v2qm-5wxj-qhj7 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwebui open webui | < 0.9.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | New CVE Received | [email protected] |