CVE-2026-54009CWE-639

Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Medium · published June 23, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.1
In the wild
Unconfirmed
What it is

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts an image_url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. an authenticated user can therefore set image_url.url to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. the user then prompts the LLM to describe / OCR the file and reads the content back. This vulnerability is fixed in 0.9.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-23T16:49Z
EPSS history
Timeline
  • 23 JUN 16:49Z
    Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field
    cvelistv5