I reported this as a security issue but it was ignored, so I am reporting it here. A user can signup with their own profile image url and there are no checks done on this and rendered on the front end as is. It can be used to track ip addresses, set tracking cookies, xss on older web browsers, do internal get references on private ips, etc.
Originally created by @qrdlgit on GitHub (May 17, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/2332
I reported this as a security issue but it was ignored, so I am reporting it here. A user can signup with their own profile image url and there are no checks done on this and rendered on the front end as is. It can be used to track ip addresses, set tracking cookies, xss on older web browsers, do internal get references on private ips, etc.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @qrdlgit on GitHub (May 17, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/2332
I reported this as a security issue but it was ignored, so I am reporting it here. A user can signup with their own profile image url and there are no checks done on this and rendered on the front end as is. It can be used to track ip addresses, set tracking cookies, xss on older web browsers, do internal get references on private ips, etc.