What is the CVSS score of EUVD-2026-52893?

EUVD-2026-52893 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Open WebUI are affected by EUVD-2026-52893?

Open WebUI versions 0.9.0 through 0.10.2 expose authenticated users to session hijacking and account takeover via a terminal file-preview vulnerability; compromise of administrator accounts creates…. A patch is available.

How to fix or mitigate EUVD-2026-52893?

Within 24 hours, identify all Open WebUI deployments running versions 0.9.0-0.10.2 and document users with terminal server access. Within 7 days, upgrade all affected instances to version 0.11.0 and review terminal access controls to minimize exposure. Within 30 days, validate upgrade completion across all instances, audit logs for suspicious account activity during the vulnerable period, and implement access restrictions limiting terminal features to essential users.

Open WebUI EUVD-2026-52893

| CVE-2026-70486 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-04 GitHub_M

GHSA-3xpf-xq7r-v8c5

XSS RCE Open Webui

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.2 HIGH

Network vector confirmed; AC:H reflects mandatory prompt-injection delivery step; PR:L for attacker's authenticated account; S:C because iframe escapes to application origin.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 04, 2026 - 21:01 EUVD

Source Code Evidence Fetched

Aug 04, 2026 - 20:36 vuln.today

Analysis Generated

Aug 04, 2026 - 20:36 vuln.today

CVE Published

Aug 04, 2026 - 20:01 cve.org

HIGH 8.2

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user with access to a configured terminal server could cause script in a previewed file to run in the Open WebUI origin, read the victim's session token from localStorage, and take over the account, with possible server-side code execution if the victim was an admin or held workspace.functions. This issue is fixed in 0.11.0.

AnalysisAI

The terminal file-preview feature in Open WebUI 0.9.0 through 0.10.2 allows an authenticated attacker with access to a configured terminal server to execute arbitrary scripts in the application's own browser origin by exploiting a hardcoded iframe sandbox misconfiguration, enabling full session token theft and account takeover. The serveUrl iframe branch unconditionally combined allow-same-origin with allow-scripts for HTML files served from the application's own domain, completely negating iframe sandbox isolation regardless of user settings. In the highest-impact scenario, if the victim holds admin privileges or workspace.functions, the account takeover extends to server-side code execution on the Open WebUI host. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; a vendor patch is available in version 0.11.0.

Technical ContextAI

The root cause is in src/lib/components/chat/FileNav/FilePreview.svelte within the serveUrl iframe branch that renders HTML files served through the terminal proxy endpoint /api/v1/terminals/{id}/files/serve/.... The HTML5 iframe sandbox attribute is designed to restrict framed content, but the documented pitfall of combining allow-same-origin with allow-scripts for same-origin content is that the framed document inherits the parent's origin context, gains DOM access, and can read localStorage and sessionStorage - rendering the sandbox entirely inert. CWE-79 (Improper Neutralization of Input During Web Page Generation) captures this: attacker-controlled HTML content is injected into the application's own origin context without sanitization or effective isolation. Compounding the issue, the existing user setting iframeSandboxAllowSameOrigin (default: off) was intended to gate this behavior but was silently ignored by the serveUrl code path; only the srcdoc branch respected it. The affected CPE is cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*, versions 0.9.0 through 0.10.2 inclusive.

RemediationAI

Upgrade Open WebUI to version 0.11.0 or later via pip install --upgrade open-webui, available at https://github.com/open-webui/open-webui/releases/tag/v0.11.0. No configuration changes are required after upgrading; HTML previews continue to render correctly. The fix in commit 65a5fad7b (PR #26907) removes the hardcoded allow-same-origin from the serveUrl iframe branch and gates it behind the iframeSandboxAllowSameOrigin user setting, which defaults to off - restoring the originally intended isolation behavior. For deployments that cannot upgrade immediately, completely removing all entries from TERMINAL_SERVER_CONNECTIONS eliminates the attack surface entirely, though this disables all terminal functionality as a trade-off. Operators who had already set a restrictive Content-Security-Policy via TERMINAL_PROXY_HEADERS were not exposed even on vulnerable versions, since those headers are merged into every proxied response including served HTML files.