The vulnerability allows a malicious user to store a script in an audio transcription upload by giving the file a polyglot name that looks like a WAV file but contains HTML. When another user opens the resulting URL, the server serves the file with a Content‑Type of text/html and no Content‑Disposition, causing the browser to execute the script in the context of the Open WebUI origin. This can lead to cookie theft, credential compromise, or other client‑side attacks.

Open WebUI versions earlier than 0.9.3. Users with verified chat.stt permission can upload the file; any other user can be tricked into visiting the URL.

The CVSS score of 8.7 categorises it as high severity. EPSS is unavailable, and it is not listed in the CISA KEV catalogue. The attack requires a verified user with upload privileges and a second target who follows a crafted link; the vector is likely a social‑engineering or phishing scenario involving the upload endpoint.