CVE-2026-54013: Open WebUI Model Profile Image XSS – Account Takeover

Technical summary

CVE-2026-54013 stems from incomplete input validation in Open WebUI's model profile image handling. The ModelMeta class lacks a validate_profile_image_url field validator that was successfully applied elsewhere, and the model image serving endpoint fails to enforce a MIME type allowlist or set the X-Content-Type-Options: nosniff header. This allows storage and retrieval of data URIs containing base64-encoded SVG payloads. When a victim navigates to the image URL, the browser interprets the SVG as trusted content and executes embedded scripts in the context of the victim's session, bypassing same-origin policy restrictions through the data URI scheme. The vulnerability maps to CWE-116 (Improper Encoding or Escaping of Output), CWE-693 (Protection Mechanism Failure), and CWE-79 (Cross-site Scripting).

Business impact

Account takeover poses a direct threat to data confidentiality and system integrity. In environments using Open WebUI for sensitive AI workloads—research, internal analytics, or development—a compromised admin or power-user account could grant attackers access to conversation history, model configurations, API keys, and downstream integrations. The attack path is asymmetric: a low-privileged user with basic workspace permissions can compromise higher-privileged accounts. For organizations relying on Open WebUI as part of a larger AI infrastructure, this becomes a pivot point for lateral movement.

Affected systems

All versions of Open WebUI prior to 0.9.6 are affected. The vulnerability requires workspace.models permission, which is enabled by default, meaning any authenticated user in a standard deployment can exploit it. Self-hosted deployments are the primary target, as Open WebUI is designed for offline operation.

Exploitability

The attack has a low attack complexity and no special network positioning required—it is fully exploitable by any authenticated user. Two barriers exist: the attacker must possess workspace.models permission (default-enabled), and the victim must click or navigate to the malicious image URL. Social engineering or embedding the image in a shared model or workspace artifact can overcome the second barrier. The CVSS score of 7.6 reflects the high impact (full account takeover) tempered by the requirement for authentication and user interaction.

Remediation

Upgrade to Open WebUI 0.9.6 or later. The fix implements the missing validate_profile_image_url validator for the ModelMeta class and adds proper MIME type validation and nosniff headers to the model image serving endpoint. Organizations should prioritize this patch in environments where Open WebUI is accessible to multiple users or integrated with sensitive workflows.

Patch guidance

1. Verify your current Open WebUI version. 2. Review the official release notes for version 0.9.6 to confirm this vulnerability is included in the patch. 3. Back up your Open WebUI configuration and database. 4. Deploy the patched version in a staging environment first to validate compatibility with your deployment and any custom integrations. 5. Update production instances and verify that model profile images are still functioning correctly post-upgrade.

Detection guidance

Monitor for suspicious activity in model profile image uploads or modifications, particularly by lower-privileged accounts. Check web server logs for requests to model image endpoints that contain data: URIs or base64-encoded payloads. Review audit logs for unusual account login patterns or permission changes immediately following model metadata updates. In containerized deployments, scan image layers and configuration for evidence of data URI payloads in model definitions.

Why prioritize this

Although the CVSS score is 7.6 (HIGH), this vulnerability should be prioritized aggressively because it enables full account takeover with minimal friction—only default permissions and user interaction are needed. The fix is simple and available; delay increases exposure window. Organizations with multi-user deployments or those integrating Open WebUI into broader AI pipelines should treat this as critical.

Risk score, explained

The 7.6 CVSS score reflects high confidentiality impact (account takeover grants access to all account data and permissions) and low integrity impact (the attacker can modify account settings and workflow artifacts). Attack vector is network-accessible, attack complexity is low, and privilege escalation is possible from unprivileged accounts. The primary mitigating factors are the requirement for prior authentication and user interaction; however, both are routine in collaborative environments.

Frequently asked questions