A significant security issue has been identified in Open WebUI, a platform commonly used for managing AI workspaces. This vulnerability, discovered by security researcher Metin Yunus Kandemir, involves a stored cross-site scripting flaw in the profile image upload feature. This flaw allows attackers to execute remote code with just a single click, potentially compromising accounts and accessing sensitive data. The issue arises because Open WebUI processes user profile pictures without properly restricting the file types. This oversight permits attackers to upload malicious SVG files that contain JavaScript payloads. When a user interacts with the image link, the browser executes the embedded JavaScript without prompting a download, leading to an immediate attack if the user is logged in. Despite the grave implications, Open WebUI developers have not acknowledged the vulnerability, leaving it unpatched in version 0.7.2. The exploit code has been made public after the developers closed the report as a duplicate and did not recognize the issue officially. Organizations using Open WebUI must now take manual steps to protect their systems, as an official patch is not available. This situation underscores the importance of proactive security measures and responsible disclosure practices to safeguard against zero-day vulnerabilities.