Summary
Open WebUI contains a stored cross-site scripting vulnerability in its DOCX preview component. An authenticated user who uploads a crafted DOCX attachment may cause script execution when an administrator previews it, potentially exposing session data and enabling instance takeover.
Open WebUI contains a stored cross-site scripting vulnerability in its DOCX preview component. An authenticated user who uploads a crafted DOCX attachment may cause script execution when an administrator previews it, potentially exposing session data and enabling instance takeover.
Affected context
The vulnerability occurs in Open WebUI deployments using the affected DOCX preview functionality. It requires an authenticated user to upload a specially crafted DOCX attachment and a privileged user, such as an administrator, to preview the resulting document. Risk is greatest where previewed document content is rendered without sufficient sanitization or isolation.
The vulnerability occurs in Open WebUI deployments using the affected DOCX preview functionality. It requires an authenticated user to upload a specially crafted DOCX attachment and a privileged user, such as an administrator, to preview the resulting document. Risk is greatest where previewed document content is rendered without sufficient sanitization or isolation.
Exploit preconditions
- Attack surface: DOCX attachment upload and browser-based document preview
- Required access: An authenticated account with permission to upload attachments
- Trigger point: Rendering the crafted document in the DocxPreview component
- Victim interaction: A privileged user must open or preview the uploaded document
- Why exploitation is possible: Document content can introduce active browser content that is not adequately neutralized before rendering
- Attack surface: DOCX attachment upload and browser-based document preview
- Required access: An authenticated account with permission to upload attachments
- Trigger point: Rendering the crafted document in the DocxPreview component
- Victim interaction: A privileged user must open or preview the uploaded document
- Why exploitation is possible: Document content can introduce active browser content that is not adequately neutralized before rendering
Why this happens
The underlying bug is insufficient output encoding or sanitization of content derived from DOCX attachments before it is inserted into a browser-rendered preview. Active content embedded in OOXML-derived document parts or hyperlink data can therefore be interpreted by the browser as executable script. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
The underlying bug is insufficient output encoding or sanitization of content derived from DOCX attachments before it is inserted into a browser-rendered preview. Active content embedded in OOXML-derived document parts or hyperlink data can therefore be interpreted by the browser as executable script. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as cross-site scripting.
Potential impact
- An attacker may execute script in a privileged user's browser context
- Session tokens or other browser-stored secrets could be exposed
- An attacker could impersonate an administrator
- The Open WebUI instance could be modified or abused through the compromised session
- Other users or connected data sources could be affected
- An attacker may execute script in a privileged user's browser context
- Session tokens or other browser-stored secrets could be exposed
- An attacker could impersonate an administrator
- The Open WebUI instance could be modified or abused through the compromised session
- Other users or connected data sources could be affected
General mitigation guidance
Mitigation generally focuses on treating uploaded documents as untrusted content throughout the preview pipeline.
Common defensive patterns include:
- Sanitizing and safely rendering all document-derived markup
- Disallowing active content and unsafe URL schemes in previews
- Applying strict output encoding appropriate to each browser context
- Isolating document previews with restrictive browser policies and sandboxing where practical
- Limiting upload and administrative privileges according to least privilege
- Reducing reliance on browser local storage for highly sensitive session material
- Applying content security policies that reduce the impact of unexpected script execution
Mitigation generally focuses on treating uploaded documents as untrusted content throughout the preview pipeline.
Common defensive patterns include:
- Sanitizing and safely rendering all document-derived markup
- Disallowing active content and unsafe URL schemes in previews
- Applying strict output encoding appropriate to each browser context
- Isolating document previews with restrictive browser policies and sandboxing where practical
- Limiting upload and administrative privileges according to least privilege
- Reducing reliance on browser local storage for highly sensitive session material
- Applying content security policies that reduce the impact of unexpected script execution
How teams detect issues like this
Organizations can look for this vulnerability through:
- Static analysis rules targeting unsafe HTML insertion and insufficient sanitization in frontend components
- Code review checks for document previews that render parsed XML, HTML, or hyperlink values
- Tests using representative malicious document fixtures and assertions that active content is inert
- Policy enforcement requiring approved sanitization libraries and restrictive preview isolation
- Monitoring unusual attachment uploads, administrator preview activity, and unexpected session use
Automated security review tools may help identify dangerous rendering patterns, but testing should also cover the complete document parsing and preview workflow.
Organizations can look for this vulnerability through:
- Static analysis rules targeting unsafe HTML insertion and insufficient sanitization in frontend components
- Code review checks for document previews that render parsed XML, HTML, or hyperlink values
- Tests using representative malicious document fixtures and assertions that active content is inert
- Policy enforcement requiring approved sanitization libraries and restrictive preview isolation
- Monitoring unusual attachment uploads, administrator preview activity, and unexpected session use
Automated security review tools may help identify dangerous rendering patterns, but testing should also cover the complete document parsing and preview workflow.
