CVE-2026-54009 Details
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts an image_url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. an authenticated user can therefore set image_url.url to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. the user then prompts the LLM to describe / OCR the file and reads the content back. This vulnerability is fixed in 0.9.6.
A cross-user file disclosure vulnerability exists in Open WebUI versions prior to 0.9.6. The issue arises in the POST /api/chat/completions endpoint, where the image_url.url parameter can be manipulated. If the URL does not begin with http://, https://, or data:image/, it is treated as a file ID and retrieved from the global file table without any ownership verification. This allows an authenticated user to access another user's files, base64-encode them, and use the data URI in a request to the language model (LLM). The LLM can then be prompted to describe or perform optical character recognition (OCR) on the file, effectively leaking its content.
Users can update to Open WebUI version 0.9.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-webui/open-webui/security/advisories/GHSA-wch8-mhj5-9frg | CISA-ADP | ExploitVendor AdvisoryMitigation |
| https://github.com/open-webui/open-webui/security/advisories/GHSA-wch8-mhj5-9frg | [email protected] | ExploitVendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwebui open webui | < 0.9.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |