{"id":"CVE-2024-7044","aliases":["GHSA-j274-m559-cj4j","PYSEC-2026-1736"],"title":"Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload","summary":"Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui <= 0.3.8"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-j274-m559-cj4j","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7044"},{"url":"https://github.com/open-webui/open-webui"},{"url":"https://huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6"}],"tags":["osv","pip"],"epss":0.00519,"epssPercentile":0.42931,"ingestedAt":"2026-07-08T18:25:50.546Z","slug":"CVE-2024-7044","body":"## Overview\n\nA Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.\n\n## Affected packages\n\n- `open-webui <= 0.3.8`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}