CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

March 20, 2025 (updated March 21, 2025)

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim’s browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

References

github.com/advisories/GHSA-j274-m559-cj4j
github.com/open-webui/open-webui
huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6
nvd.nist.gov/vuln/detail/CVE-2024-7044

Code Behaviors & Features

Detect and mitigate CVE-2024-7044 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →