CVE-2026-45314

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45314

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45314.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45314

Aliases

Published

2026-05-15T21:31:24.526Z

Modified

2026-08-12T03:51:41.760705907Z

Severity

7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

Details

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profileimageurl values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves this SVG as image/svg+xml without sanitization, allowing attacker-controlled script handlers (for example onload) to execute when the profile-image URL is opened in the browser. This vulnerability is fixed in 0.9.3.

Database specific

{
    "cwe_ids": [
        "CWE-87"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45314.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

Fixed

adc9076d176679fd913c5dc44d0bd4d8f86d1fc3

Database specific

Show details

{
    "cpe": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.3"
        }
    ]
}

Affected versions

v0.*

v0.1.102

v0.1.103

v0.1.104

v0.1.105

v0.1.106

v0.1.107

v0.1.108

v0.1.109

v0.1.110

v0.1.111

v0.1.112

v0.1.113

v0.1.114

v0.1.115

v0.1.116

v0.1.117

v0.1.118

v0.1.119

v0.1.120

v0.1.121

v0.1.122

v0.1.123

v0.1.124

v0.1.125

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.17

v0.3.18

v0.3.19

v0.3.2

v0.3.20

v0.3.21

v0.3.22

v0.3.23

v0.3.24

v0.3.25

v0.3.26

v0.3.27

v0.3.28

v0.3.29

v0.3.3

v0.3.30

v0.3.31

v0.3.32

v0.3.33

v0.3.34

v0.3.35

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.14

v0.5.15

v0.5.16

v0.5.17

v0.5.18

v0.5.19

v0.5.2

v0.5.20

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.16

v0.6.17

v0.6.18

v0.6.19

v0.6.2

v0.6.20

v0.6.21

v0.6.22

v0.6.23

v0.6.24

v0.6.25

v0.6.26

v0.6.27

v0.6.28

v0.6.29

v0.6.3

v0.6.30

v0.6.31

v0.6.32

v0.6.33

v0.6.34

v0.6.35

v0.6.36

v0.6.37

v0.6.38

v0.6.39

v0.6.4

v0.6.40

v0.6.41

v0.6.42

v0.6.43

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v0.7.0

v0.7.1

v0.7.2

v0.8.0

v0.8.1

v0.8.10

v0.8.11

v0.8.12

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.1

v0.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45314.json"