GHSA-jjp7-g2jw-wh3j: Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

Summary

Any authenticated Open WebUI user can overwrite any file by ID through the POST /api/v1/retrieval/process/files/batch endpoint, because process_files_batch() in backend/open_webui/routers/retrieval.py has no ownership check before writing. Attackers can obtain valid file UUIDs from GET /api/v1/knowledge/{id}/files for any knowledge base they can read, and the overwritten content is then served to the LLM via RAG. Tested on Open WebUI 0.8.3 in a default Docker configuration.

Mitigation

Suggested fix: add an ownership check before writing, rejecting the file with "Permission denied: not file owner" unless db_file.user_id matches the requesting user or the user is an admin. No released fixed version is stated in the source.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• open-webuiPyPILLM dependency since 2024-05-20

Related items

• InfoTop GenAI security resources — November 2026Similar attack · Adversa AI Blog
• InfoSecurity, Privacy, and Trustworthy Design for Retrieval-Augmented Generation SystemsSimilar attack · OpenAlex (peer-reviewed AI security)
• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• InfoDecision Models as Retrieval Gates Against Injection and PollutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSigned but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented GenerationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)