THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-70486 (HIGH 8.2) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any auth

[NVD] CVE-2026-70486 (HIGH 8.2) — Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any auth

lownvdPublished 2026-08-04

CVE-2026-70486 CVSS: 8.2 HIGH Published: 2026-08-04T20:16:55.747

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, the terminal file-preview serveUrl iframe branch always granted allow-same-origin together with allow-scripts for HTML files served from the application origin. Any authenticated user with access to a configured terminal se

Indicators of compromise

CVE-2026-70486cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-70486