Summary
Open WebUI versions from 0.9.0 through before 0.11.0 contain a cross-site scripting weakness in the terminal file-preview iframe handling for HTML files. An authenticated user with access to a configured terminal server may cause previewed script to execute in the Open WebUI origin, potentially exposing session tokens and enabling account takeover.
Affected context
The issue occurs in Open WebUI terminal file previews when HTML content is served through the application origin and rendered in an iframe configured with both allow-same-origin and allow-scripts. Risk depends on the deployment's terminal-server configuration, the attacker's authenticated access to that server, and whether a victim views the crafted preview.
Exploit preconditions
- Attack surface: Terminal file-preview functionality for HTML files
- Required access: An authenticated user with access to a configured terminal server
- Victim interaction: A privileged or otherwise authenticated user must open the affected preview
- Trigger point: Rendering the HTML file in the terminal preview iframe
- Why exploitation is possible: The iframe retains the Open WebUI origin while permitting scripts to run, allowing preview content to access origin-scoped browser data such as localStorage
Why this happens
The vulnerability results from an unsafe iframe isolation pattern. Granting both allow-same-origin and allow-scripts to HTML content served from the application origin allows active preview content to execute with the application's origin privileges. This maps primarily to CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), and is also related to CWE-1021, Improper Restriction of Rendered UI Layers or Frames.
Potential impact
- A malicious preview may execute JavaScript in the Open WebUI origin
- An attacker may steal a victim's session token from localStorage
- The victim's account may be taken over
- A compromised administrator account could enable broader application or workspace abuse
- Server-side code execution may be possible when the victim has privileged workspace functions or equivalent capabilities
General mitigation guidance
Mitigation generally focuses on isolating untrusted preview content from the application origin and reducing the authority of rendered files. Safer patterns include serving previews from a distinct, non-privileged origin; disabling script execution for untrusted documents; using restrictive iframe sandbox policies without unnecessary origin privileges; and applying context-appropriate content security policies. Session material should not be exposed to scripts through browser storage where avoidable, and terminal access and workspace capabilities should follow least-privilege principles.
How teams detect issues like this
Detection can include static and dynamic review of iframe construction, especially combinations of allow-same-origin and allow-scripts applied to user-controlled HTML. Code review should identify previews served from the application origin, browser-storage access by rendered content, and missing content isolation. Security testing can verify that previewed documents cannot access application cookies, localStorage, authenticated APIs, or privileged UI actions. Policy checks may require untrusted content to use a separate origin and prohibit active content in file previews.
