Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

## Summary An application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this vulnerability, and any user who views the compromised image (e.g., a profile picture) will unknowingly send a GET request to the attacker-controlled URL. This can lead to cookie theft, denial of service (DoS), or other malicious actions. This can be exploited in various locations, including: • Profile picture • Model picture • Hidden images in shared chats • Images within shared notes ## Details ### Vulnerable Code: This appears to occur in most locations where images can be uploaded/rendered. Here are found sinks: **Profile Image in chat** • Note: rendering profile picture in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ProfileImage.svelte#L16Code **Profile Picture edit** • Note: Profile picture rendering in edit • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Settings/Account.svelte#L205 **Profile Image Navbar** • Note: Profile picture rendering in navbar • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Navbar.svelte#L237 **Profile Image UserList** • Note: rendering images in user list admin panel • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Users/UserList.svelte#L399 **Images in chat** • Note: rendering images in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/Image.svelte#L35 **Image in chat** • Note: Image sent in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/channel/Messages/Message.svelte#L192 **Model image in chat** • Note: Model image rendering in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Placeholder.svelte#L128 **Model image in chat response** • Note: Model image rendering in the assistant response • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ResponseMessage.svelte#L612 **Model Image Admin settings** • Note: Model image rendering in the admin settings • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Settings/Models.svelte#L336 **Model Image Workspace** • Note: Model image rendering in the workspace • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models.svelte#L336 **Model Image Edit** • Note: Model image rendering in the edit modal • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models/ModelEditor.svelte#L407 **Image in Notes** • Note: Image rendering in shared note • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/RichTextInput/Image/image.ts#L140 • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/UserMessage.svelte#L184 **Root Cause** 1. Insecure display of image • Application is sending a GET request to the unvalidated image url 2. Lack of Input Validation • Image url is not validated for filetype ## PoCs ### PoC (profile picture) **Environment** • Open-WebUl latest version (v0.6.41) • Valid user **Step 1: Create a Malicious Link** • Set up a ser

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Severity from

GitHub (reviewed advisory)

Weakness

CWE-20, CWE-352

Also known as

CVE-2026-45317, PYSEC-2026-2738

• github.com/open-webui/open-webui/security/advisories/GHSA-j6w6-986j-2m2m
• nvd.nist.gov/vuln/detail/CVE-2026-45317
• github.com/open-webui/open-webui
• github.com/open-webui/open-webui/releases/tag/v0.9.3