An authenticated user with access to a terminal server can serve an HTML file that, due to the terminal file-preview iframe being hard‑coded with allow‑same‑origin and allow‑scripts, runs in the Open WebUI origin. The embedded script can read the victim's session token from localStorage, enabling account takeover, and, if the victim holds admin privileges or workspace.functions, may allow server‑side code execution. This vulnerability is a Same‑Origin Cross‑Site Scripting and is identified as CWE‑79 and CWE‑1021.

The vulnerability is present in open-webui:open-webui in versions 0.9.0 through 0.10.x, which are included in the 0.11.0 release. Any deployment of Open WebUI with the terminal file-preview functionality enabled and an authenticated user able to inject an HTML file into the preview is affected. The issue was fixed in release 0.11.0.

The CVSS score of 8.2 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV. Attackers can exploit the flaw by uploading a malicious HTML file to a terminal session they have access to; because the iframe runs with same‑origin privileges, the attacker’s script gains the victim’s browser context. If the victim is an admin or has workspace.functions, the exploit can lead to server‑side code execution, making this a potentially critical risk for hosted deployments.