CVE-2024-7044
Published: 20 March 2025
Summary
CVE-2024-7044 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Openwebui Open Webui. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2024-7044 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, in the chat file upload functionality of open-webui/open-webui version 0.3.8. Published on 2025-03-20, it carries a CVSS v3.1 base score of 8.9 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L). The flaw allows an attacker to inject malicious content into an uploaded file, which persists and executes JavaScript when accessed.
An authenticated attacker with low privileges (PR:L) can exploit this by uploading a specially crafted file to the chat interface. When a victim user interacts with the file via a direct URL or shared chat, the injected JavaScript executes in the victim's browser context due to insufficient input sanitization. Successful exploitation enables theft of sensitive user data, session hijacking, malware distribution, and phishing attacks, with high confidentiality and integrity impacts across a changed scope.
Mitigation details and patches are outlined in the primary advisory at https://huntr.com/bounties/c25a885c-d6e2-4169-9ee8-4d33bcbb5ef6. Security practitioners should review this reference for upgrade instructions and workarounds specific to open-webui deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6968
Vulnerability details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript…
more
in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS via malicious file upload enables arbitrary JS execution in victims' browsers upon access via URL/shared chat, facilitating drive-by compromise, public-facing app exploitation, JavaScript execution, browser session hijacking, web session cookie theft, and browser credential theft.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-15 directly prevents stored XSS execution by filtering malicious JavaScript from uploaded file contents before rendering or sharing in the victim's browser.
SI-10 addresses the root cause by validating and sanitizing inputs during file uploads to block injection of malicious scripts.
SI-2 ensures timely identification, reporting, and patching of the specific stored XSS flaw in the chat file upload functionality.