Cross-site scripting in Open WebUI - CVE-2026-45318
Published: May 11, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in a victim's browser.
The vulnerability exists due to improper neutralization of input during web page generation in Office file preview rendering in FilePreview.svelte and FileItemModal.svelte when rendering HTML converted from user-supplied Office, Excel, or DOCX files via Svelte {@html} without DOMPurify sanitization. A remote user can upload a specially crafted document and have it rendered during file preview to execute arbitrary script in a victim's browser.
User interaction is required when a user previews the crafted file, and shared multi-user instances are especially exposed because the malicious file is stored server-side and can affect each viewer.