GHSA-r472-mw7m-967f: Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

Summary

Multiple Open WebUI endpoints accept a user-supplied `file_id` and attach that file to a resource the caller controls without checking the caller's access to the file. Path 1 is `POST /api/v1/folders/{id}/update` through the folder knowledge consumer in `backend/open_webui/utils/middleware.py`, where the referenced file becomes RAG context for chat completions. Path 2 is the knowledge-base attach endpoints in `backend/open_webui/routers/knowledge.py`, which grant read and write access to the file through `/api/v1/files/{id}/content` and `/api/v1/files/{id}/data/content/update`. An authenticated user who knows another user's file UUID can exfiltrate that file, and on Path 2 also overwrite it.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database