CVE-2024-7044

Affected versions of the open-webui package are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the chat file upload functionality. The file upload feature fails to properly validate or sanitize file content before storage and subsequent display, allowing malicious JavaScript to be embedded within uploaded files. An attacker can exploit this vulnerability by uploading a file containing malicious JavaScript code and sharing the file URL or chat session with victims, causing the script to execute in the victims' browsers and potentially leading to session hijacking, data theft, or phishing attacks.