Vulnerability Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no validate_profile_image_url field validator, and the model image serving endpoint has no MIME allowlist or nosniff header. Any authenticated user with workspace.models permission (enabled by default) can store a data:image/svg+xml;base64,... payload in a model's profile image and achieve full account takeover of anyone who navigates to the image URL. This vulnerability is fixed in 0.9.6.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openwebui | Open Webui | < 0.9.6 |
Related Weaknesses (CWE)
References
- https://github.com/open-webui/open-webui/security/advisories/GHSA-v2qm-5wxj-qhj7ExploitMitigationVendor Advisory
- https://github.com/open-webui/open-webui/security/advisories/GHSA-v2qm-5wxj-qhj7ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-54013?
CVE-2026-54013 is a vulnerability with a CVSS score of 7.6 (HIGH). Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forg...
How severe is CVE-2026-54013?
CVE-2026-54013 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54013?
Check the references section above for vendor advisories and patch information. Affected products include: Openwebui Open Webui.