CVE-2025-65959
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in Open WebUI allows authenticated users to upload malicious Markdown files containing SVG tags that execute JavaScript when victims download notes as PDFs. This enables session token theft from both admin and regular users. Unauthenticated attackers can also exploit this by sharing specially crafted files.
💻 Affected Systems
- Open WebUI
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover of admin users leading to full system compromise, data exfiltration, and potential lateral movement within the environment.
Likely Case
Session hijacking leading to unauthorized access to user accounts, data theft, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and output encoding, but still potential for limited data exposure.
🎯 Exploit Status
Exploitation requires creating malicious Markdown files with SVG tags and convincing users to download them as PDFs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.37
Vendor Advisory: https://github.com/open-webui/open-webui/security/advisories/GHSA-8wvc-869r-xfqf
Restart Required: Yes
Instructions:
1. Backup your Open WebUI configuration and data. 2. Update to version 0.6.37 or later using your deployment method (Docker, manual install, etc.). 3. Restart the Open WebUI service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Notes PDF Download
allTemporarily disable the Notes PDF download functionality to prevent exploitation.
Modify Open WebUI configuration to disable PDF export features
Input Validation Filter
allImplement server-side filtering to sanitize SVG tags in Markdown imports.
Add content security policies and input validation rules
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent JavaScript execution from untrusted sources.
- Monitor and restrict file uploads to trusted users only, and implement file type validation for Markdown imports.
🔍 How to Verify
Check if Vulnerable:
Check if Open WebUI version is below 0.6.37 and if Notes PDF download functionality is enabled.Check Version:
Check Open WebUI web interface settings or deployment configuration for version information.Verify Fix Applied:
Confirm version is 0.6.37 or higher and test PDF download functionality with safe test files.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload patterns
- Multiple PDF download requests from single users
- Error logs related to SVG parsing
Network Indicators:
- Unexpected external file downloads
- Suspicious file sharing activity
SIEM Query:
Search for 'open-webui' AND ('pdf download' OR 'markdown import') with unusual frequency or from suspicious sources.