What is the CVSS score of CVE-2025-65959?

CVE-2025-65959 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Open Webui are affected by CVE-2025-65959?

Open WebUI instances running versions prior to 0.6.37 face a critical risk of session token theft and unauthorized access through malicious PDF downloads.. A patch is available.

Is there a public PoC exploit available for CVE-2025-65959?

Yes, a public proof-of-concept exploit is available for CVE-2025-65959. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-65959?

Within 24 hours: Identify all Open WebUI deployments and their current versions; notify users to avoid downloading notes from untrusted sources. Within 7 days: Upgrade all instances to version 0.6.37 or later; perform a security audit of session token usage and user access logs for signs of compromise. Within 30 days: Implement mandatory security awareness training on social engineering risks; establish a change management process for critical security patches to prevent future delays.

Open Webui CVE-2025-65959

EUVD-2025-201263 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-04 security-advisories@github.com

GHSA-8wvc-869r-xfqf

XSS Open Webui

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201263

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

Patch released

Mar 15, 2026 - 16:35 nvd

Patch available

PoC Detected

Dec 10, 2025 - 15:35 vuln.today

Public exploit code

CVE Published

Dec 04, 2025 - 21:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.