CVE-2026-70486
Received Received - Intake

Open WebUI Origin Confusion via Terminal File Preview

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user with access to a configured terminal server could cause script in a previewed file to run in the Open WebUI origin, read the victim's session token from localStorage, and take over the account, with possible server-side code execution if the victim was an admin or held workspace.functions. This issue is fixed in 0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-05
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-70486
EUVD
EUVD-2026-52893

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open_webui open_webui to 0.11.0 (inc)
open_webui open_webui From 0.9.0 (inc) to 0.11.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-70486 is a Same-origin Cross-Site Scripting (XSS) vulnerability in Open WebUI versions 0.9.0 to 0.11.0. It allows an authenticated user with terminal server access to execute arbitrary scripts in the Open WebUI origin by exploiting the iframe file-preview feature. The vulnerability occurs because HTML file previews rendered in an iframe include the allow-same-origin sandbox attribute, which removes isolation when the file is served from the application's origin. This enables scripts in previewed files to read localStorage, including session tokens, leading to account takeover.

Detection Guidance

Check Open WebUI version with `curl -s http://localhost:8080/api/version | grep version` or via admin panel. If version is below 0.11.0, the system is vulnerable. Inspect network traffic for iframe requests to terminal-served files with `allow-same-origin` attributes.

Impact Analysis

An attacker could take over your Open WebUI account by tricking you into viewing a malicious HTML file in the terminal preview. If you are an admin or have workspace.functions privileges, the attacker might execute server-side code remotely. The attack requires at least one configured terminal server accessible to the victim and no additional interaction beyond having the chat open, as the preview opens automatically.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Account takeover and potential server-side code execution may result in data breaches, unauthorized disclosure, or modification of personal or health data, leading to compliance violations and legal consequences.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.0 or later immediately. Disable terminal server access if not needed. Configure `iframeSandboxAllowSameOrigin` to false in settings. Apply CSP headers to iframe responses if custom deployment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70486. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart