Open WebUI EUVD-2026-97592

Exploitation requires (1) an authenticated account on the target Open WebUI instance with permission to upload DOCX chat attachments (PR:L), (2) the attacker embedding an OOXML altChunk HTML part or a script-scheme hyperlink inside the DOCX, and (3) a higher-privileged victim - specifically an administrator - actively opening and previewing that attachment in the DocxPreview.svelte component (UI:A). Only versions 0.11.1 through 0.11.3 are affected; 0.11.4 and later are fixed. Limiting factors that reduce real-world risk: the attacker must already hold a valid (even if low-privileged) account, the payload does nothing until an admin voluntarily previews the file, and impact hinges on the admin session token being retrievable from browser local storage. There is no indication a non-default configuration is required - document preview is core functionality.

This is a credible, above-average-priority issue but not an emergency. The provided CVSS 4.0 vector (8.4, AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H) indicates a network-reachable, low-complexity attack that nonetheless requires an authenticated low-privileged account (PR:L) and active victim interaction (UI:A) - a higher-privileged user must actually open/preview the malicious DOCX. The high VC:H/VI:H reflects that successful exploitation yields administrator session-token theft and full instance takeover, which is a realistic and severe technical impact for a stored XSS. Mitigating the raw score: no EPSS probability was supplied, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation or mass scanning. The dependency on both a valid account and an administrator voluntarily previewing the attachment makes this more suited to targeted/insider or multi-tenant abuse than opportunistic internet-wide compromise. Net: treat as a prompt-patch item (especially for shared/multi-user Open WebUI instances), not a drop-everything KEV-class threat. Note the input only provides a CVSS 4.0 vector (no 3.1 vector) and no EPSS/KEV/POC signals - risk framing is based on CVSS plus description alone.

A low-privileged but authenticated Open WebUI user crafts a DOCX file containing an OOXML altChunk HTML part (or a script-scheme hyperlink) and uploads it as a chat attachment. When an administrator later opens the conversation and previews the attachment in DocxPreview.svelte, the embedded script executes in the admin's browser, exfiltrating the admin session token from local storage to the attacker, who then uses it to take over the instance. No public exploit code is referenced in the provided data, and exploitation requires the admin to actively open the preview (UI:A).