Open WebUI CVE-2026-45315: Polyglot Upload Enables XSS
The National Vulnerability Database has disclosed CVE-2026-45315, a high-severity vulnerability affecting Open WebUI, a self-hosted AI platform. This flaw, present in versions prior to 0.9.3, allows a verified user with the default chat.stt permission to upload a malicious polyglot WAV+HTML file. The platform’s audio transcription endpoint extracts the file extension from the user-supplied filename, saving it under CACHE_DIR/audio/transcriptions/.
The critical issue lies in how the /cache/{path} route serves these files. The National Vulnerability Database explains that FileResponse sets the Content-Type based on the on-disk extension and fails to emit a Content-Disposition header. This allows an attacker to name a polyglot file pwn.html, tricking another user into opening the resulting URL. The response is then rendered as text/html, executing any embedded <script> within the Open WebUI origin, leading to Cross-Site Scripting (XSS).
This is a classic case of improper input validation and insecure file handling, combining CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-434 (Unrestricted Upload of File with Dangerous Type), and CWE-646 (Improper Restriction of Naming a File). The CVSS score of 8.7 (High) reflects the significant impact of arbitrary script execution in the context of a self-hosted AI platform. The National Vulnerability Database confirms the vulnerability is fixed in version 0.9.3.
What This Means For You
- If your organization uses Open WebUI, you need to immediately patch to version 0.9.3 or later. This XSS vulnerability, even requiring a verified user, can lead to session hijacking, data exfiltration, or further compromise of the platform from within a trusted context. Audit your Open WebUI instances for any unusual file uploads or suspicious activity, especially related to the audio transcription functionality.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-45315: Open WebUI Polyglot WAV+HTML Upload for XSS
title: CVE-2026-45315: Open WebUI Polyglot WAV+HTML Upload for XSS
id: scw-2026-05-15-ai-1
status: experimental
level: high
description: |
Detects the upload of a polyglot WAV+HTML file to the audio transcription endpoint in Open WebUI versions prior to 0.9.3. This specific upload pattern, combined with the file extension manipulation, is indicative of an attempt to exploit CVE-2026-45315 for Cross-Site Scripting (XSS) by tricking users into opening a crafted URL that serves the malicious file as HTML.
author: SCW Feed Engine (AI-generated)
date: 2026-05-15
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-45315/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/audio/transcriptions/'
cs-method:
- 'POST'
sc-status:
- '200'
selection_filename:
uri|contains:
- '.wav'
uri|endswith:
- '.html'
condition: selection AND selection_filename
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-45315 | XSS | Open WebUI versions prior to 0.9.3 |
| CVE-2026-45315 | Path Traversal | Open WebUI audio transcription upload endpoint saving files under CACHE_DIR/audio/transcriptions/.. |
| CVE-2026-45315 | XSS | Open WebUI /cache/{path} route serving user-supplied files with Content-Type from on-disk extension |
| CVE-2026-45315 | XSS | Open WebUI authenticated users with chat.stt permission uploading polyglot WAV+HTML files |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 16, 2026 at 01:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Open WebUI XSS Allows Privilege Escalation to Super Admin
CVE-2026-45665 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, a Stored Cross-Site Scripting (XSS) vulnerability exists...
CVE-2026-45351 — Open WebUI is a self-hosted artificial intelligence
CVE-2026-45351 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.9, when a regular user [non-admin] logs into...
CVE-2026-45350: Open WebUI API Flaw Exposes Tools to Unauthorized Access
CVE-2026-45350 — Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.6, there is a vulnerability in chat completion...