MEDIUM 6.8
PYSEC-2026-1736
Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload
빠른 조치
PYSEC-2026-1736 — open-webui: 아래 명령으로 수정 버전으로 올리세요.
pip install --upgrade 'open-webui>=0.3.33'상세
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
참고
- https://nvd.nist.gov/vuln/detail/CVE-2024-7044 [ADVISORY]
- https://github.com/open-webui/open-webui [PACKAGE]
- https://huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6 [WEB]
- https://pypi.org/project/open-webui [PACKAGE]
- https://github.com/advisories/GHSA-j274-m559-cj4j [ADVISORY]
- https://github.com/open-webui/open-webui/commit/0da0e12096cc771ce4359c163e03c5a754d95c5e [FIX]