CVE-2024-7044

HIGH

8.9

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

CVE Details

CVSS v3.1 Score8.9

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published3/20/2025

Last Modified7/29/2025

Sourcenvd

Honeypot Sightings0

Affected Products

openwebui:open_webui

Weaknesses (CWE)

CWE-79

References

https://huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6(security@huntr.dev)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.