CVE-2026-109290: Open WebUI: stored XSS via DOCX preview enables admin takeover

HIGHPoC AVAILABLECISA: ATTEND

Published October 12, 2026

CISO Take

Open WebUI versions 0.11.1 up to 0.11.4 contain a stored cross-site scripting flaw in the DOCX preview component, where a low-privileged authenticated user can upload a crafted document that runs script in the browser of any administrator who previews it. The script can read the admin's session token from local storage, giving the attacker full control of the instance, including its connected models, API keys, and stored conversations. No public exploit, Nuclei template, or KEV listing exists and EPSS data is not yet available, so exploitation is not currently observed. However, the attack needs only a crafted file and a single admin click, and the package has a history of 186 other CVEs, so weaponization is likely to be quick. Upgrade to 0.11.4 or later, and until then restrict file upload rights and tell administrators not to preview DOCX attachments from untrusted users.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High (CVSS 7.3). The flaw is network-reachable, low complexity, and needs only a low-privileged account plus one admin interaction. Confidentiality and integrity impact is high because a stolen admin session token gives full control of the platform. Exposure is greatest in multi-user deployments where many people can upload files and admins review them. Exploitation is not currently observed (not in KEV, no public exploit, no scanner template, EPSS unavailable). The package has 186 other CVEs and only 3 tracked downstream dependents, so the blast radius is mostly the individual deployment itself.

How does the attack unfold?

Initial Access

An authenticated low-privilege user uploads a DOCX with an altChunk HTML part or script-scheme hyperlink.

AML.T0049

Execution

An administrator previews the attachment and the embedded script runs in the Open WebUI origin.

AML.T0011.003

Credential Access

The script reads the admin session token from local storage and sends it to the attacker.

AML.T0091.000

Impact

The attacker takes over the instance, accessing user chats, API keys, model connections and configuration.

Initial Access

An authenticated low-privilege user uploads a DOCX with an altChunk HTML part or script-scheme hyperlink.

AML.T0049

Execution

An administrator previews the attachment and the embedded script runs in the Open WebUI origin.

AML.T0011.003

Credential Access

The script reads the admin session token from local storage and sends it to the attacker.

AML.T0091.000

Impact

The attacker takes over the instance, accessing user chats, API keys, model connections and configuration.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade open-webui to 0.11.4 or later (pip install -U open-webui, or pull the patched container image). 2) Until patched, disable or restrict file uploads for non-trusted users and tell administrators not to preview DOCX attachments from other users. 3) Apply a strict Content-Security-Policy that blocks inline scripts and javascript: URLs at the reverse proxy. 4) Review uploaded DOCX files from the exposure window for altChunk parts or hyperlinks with script schemes (unzip and inspect word/document.xml and its relationships). 5) If compromise is suspected, rotate admin sessions and secret keys, revoke API keys, and audit admin actions, new users, and changes to functions or connections. 6) Limit the number of admin accounts and require admins to use separate browser profiles.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageFrameworkAPIAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and recovery procedures

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-109290?

Is CVE-2026-109290 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-109290, increasing the risk of exploitation.

How to fix CVE-2026-109290?

1) Upgrade open-webui to 0.11.4 or later (pip install -U open-webui, or pull the patched container image). 2) Until patched, disable or restrict file uploads for non-trusted users and tell administrators not to preview DOCX attachments from other users. 3) Apply a strict Content-Security-Policy that blocks inline scripts and javascript: URLs at the reverse proxy. 4) Review uploaded DOCX files from the exposure window for altChunk parts or hyperlinks with script schemes (unzip and inspect word/document.xml and its relationships). 5) If compromise is suspected, rotate admin sessions and secret keys, revoke API keys, and audit admin actions, new users, and changes to functions or connections. 6) Limit the number of admin accounts and require admins to use separate browser profiles.

What systems are affected by CVE-2026-109290?

This vulnerability affects the following AI/ML architecture patterns: Self-hosted LLM chat front ends, RAG pipelines with document upload, Multi-user enterprise AI assistant portals, Model serving gateways (Ollama / OpenAI-compatible backends).

What is the CVSS score for CVE-2026-109290?

CVE-2026-109290 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.31%.

What is the AI security impact?

Affected AI Architectures

Self-hosted LLM chat front endsRAG pipelines with document uploadMulti-user enterprise AI assistant portalsModel serving gateways (Ollama / OpenAI-compatible backends)

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.

Exploitation Scenario

An attacker with an ordinary user account on a company's Open WebUI portal builds a DOCX whose OOXML contains an altChunk HTML part or a hyperlink with a javascript: scheme. They attach it to a chat or knowledge base upload, then ask the admin for help or file a support request that mentions the document. When the admin opens the attachment preview, the script runs in the Open WebUI origin, reads the session token from local storage, and sends it to the attacker's server. The attacker then uses the token as the admin, exports user chats and API keys, edits model connections, and may add a malicious function to gain code execution on the server.

Weaknesses (CWE)

CWE-1021Improper Restriction of Rendered UI Layers or Frames CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1021 — Improper Restriction of Rendered UI Layers or Frames: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.

[Implementation] The use of X-Frame-Options allows developers of web content to restrict the usage of their application within the form of overlays, frames, or iFrames. The developer can indicate from which domains can frame the content. The concept of X-Frame-Options is well documented, but implementation of this protection mechanism is in development to cover gaps. There is a need for allowing frames from multiple domains.
[Implementation] A developer can use a "frame-breaker" script in each page that should not be framed. This is very helpful for legacy browsers that do not support X-Frame-Options security feature previously mentioned. It is also important to note that this tactic has been circumvented or bypassed. Improper usage of frames can persist in the web application through nested frames. The "frame-breaking" script does not intuitively account for multiple nested frames that can be presented to the user.

Source: MITRE CWE corpus.