GHSA-wch8-mhj5-9frg: Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Summary

Open WebUI's POST /api/chat/completions endpoint treats an image_url.url value that does not start with http://, https:// or data:image/ as a file id. convert_url_images_to_base64 then resolves it through Files.get_file_by_id, which has no ownership filter, so an authenticated user can read another user's file, base64-encode it and have the LLM describe it. The same class of flaw as CVE-2026-44560 persists because the file router's has_access_to_file checks were not applied to this conversion path.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• MediumCVE-2026-121938: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…Similar attack · NVD/CVE Database
• MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
• InfoResidual Attribute Leakage Is an Interface: Auditing Privacy Evaluation After Text De-identificationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement StudySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)