7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54013

CVE-2026-54013: Open WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no validate_profile_image_url field validator, and the model image serving endpoint has no MIME allowlist or nosniff header. Any authenticated user with workspace.models permission (enabled by default) can store a data:image/svg+xml;base64,... payload in a model's profile image and achieve full account takeover of anyone who navigates to the image URL. This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54013

CVE-2026-54013:

7.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Open WebUI, originating from an incomplete fix for previous, similar vulnerabilities (GHSA-3wgj-c2hg-vm6q and GHSA-3856-3vxq-m6fc). While user and webhook profile images were patched to prevent SVG-based XSS, the same security measures were not applied to model profile images.

The root cause is twofold:

Input Validation Failure: The ModelMeta Pydantic class in backend/open_webui/models/models.py lacked a @field_validator for the profile_image_url field. This allowed malicious data:image/svg+xml URIs to be saved to the database through API endpoints for creating, updating, or importing models.
Output Handling Failure: The get_model_profile_image function in backend/open_webui/routers/models.py, which serves the image to the user's browser, did not validate the MIME type of the data URI before serving it. It also failed to set the X-Content-Type-Options: nosniff HTTP header in the response.

An attacker could exploit this by creating or updating a model and setting its profile image to a crafted SVG payload disguised as a data URI. When another user's browser requests this image, the server would respond with the SVG content and a Content-Type: image/svg+xml header. Without the nosniff header, the browser renders the SVG, executing the embedded JavaScript in the context of the Open WebUI origin. This allows the attacker to steal the victim's authentication token from localStorage, leading to a full account takeover.

Vulnerable functions

get_model_profile_image

backend/open_webui/routers/models.py

This asynchronous function is responsible for serving the profile image of a model. The vulnerability lies in the fact that, prior to the patch, it would serve any `data:` URI's content without proper validation of its MIME type. An attacker could store a `data:image/svg+xml` payload, and this function would serve it with a `image/svg+xml` content type. Crucially, it also failed to include the `X-Content-Type-Options: nosniff` header, which allowed browsers to render the SVG and execute any embedded JavaScript, leading to a stored Cross-Site Scripting (XSS) attack in the user's browser, within the application's origin.

ModelMeta

backend/open_webui/models/models.py

This Pydantic model represents the metadata for a model, including its `profile_image_url`. The vulnerability is the absence of input validation on the `profile_image_url` field. This allowed any string, including a malicious `data:image/svg+xml;base64,...` payload, to be assigned to this field and persisted. While not a function itself, any API endpoint that accepts and processes this model (such as for creating or updating models) becomes a vector for storing the malicious payload.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.