{
 "id": "AIR-2026-0796",
 "slug": "cve-2025-46571-open-webui-stored-xss-via-uploaded-html-file",
 "title": "CVE-2025-46571: Open WebUI stored XSS via uploaded HTML file",
 "summary": "Low privileged users can upload HTML files containing JavaScript code via an API endpoint in Open WebUI. The uploaded script executes in the browser of anyone who opens the file.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-07-07",
 "incident_date_precision": "day",
 "first_reported": "2025-05-05",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46571",
   "publisher": "NVD",
   "title": "CVE-2025-46571: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.",
   "published_at": "2025-05-05"
  },
  {
   "url": "https://github.com/advisories/GHSA-8gh5-qqh8-hq3x",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2025-46571: Open WebUI  allows limited stored XSS vila uploaded html file",
   "published_at": "2026-07-07"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2025-46571",
  "xss"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}