AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2025-65959

HIGH · CVSS 8.7 EPSS 0.23% Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2025-12-04 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.7. It affects Java. Public exploit code or proof-of-concept references have been detected in its references. Exploitation may require the attacker to be authenticated.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2025-65959
Severity
HIGH
CVSS
8.7
EPSS
0.23%
Java

Original NVD Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37.

Related CVEs

Other vulnerabilities affecting the same vendor(s)