CVE-2024-7044: Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

March 20, 2025 (updated March 21, 2025)

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim’s browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

References

github.com/advisories/GHSA-j274-m559-cj4j
github.com/open-webui/open-webui
huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6
nvd.nist.gov/vuln/detail/CVE-2024-7044

Code Behaviors & Features

Detect and mitigate CVE-2024-7044 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →