CVE-2026-109290
Received Received - Intake

Stored XSS in Open WebUI via DOCX Preview

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109290
EUVD
EUVD-2026-97592

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-webui open-webui 0.11.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open WebUI versions before 0.11.4 have a stored cross-site scripting flaw in DocxPreview.svelte. Authenticated users can upload malicious DOCX files containing embedded HTML or script links. When an administrator previews these files, the script executes, stealing session tokens from local storage to take over the Open WebUI instance.

Detection Guidance

Check for uploaded DOCX files in Open WebUI instances running versions before 0.11.4. Inspect file contents for OOXML altChunk HTML parts or script-scheme hyperlinks. Monitor for unusual administrator session activity or unauthorized access.

Impact Analysis

If exploited, attackers can gain full control of your Open WebUI instance by stealing an admin's session token. This allows unauthorized access to sensitive data, system manipulation, or further attacks within your environment. The impact depends on the admin's privileges and data stored in the instance.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR (data protection) and HIPAA (health data privacy). Organizations may face fines, legal penalties, or reputational damage due to non-compliance if sensitive data is compromised through this flaw.

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later. Remove or review all suspicious DOCX attachments. Implement strict file upload validation to block HTML or script-containing files. Monitor for signs of exploitation such as unauthorized session tokens or admin access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart