6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54009

CVE-2026-54009: Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts an image_url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. an authenticated user can therefore set image_url.url to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. the user then prompts the LLM to describe / OCR the file and reads the content back. This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54009

CVE-2026-54009:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

An analysis of the security advisory reveals a critical authorization bypass vulnerability in Open WebUI. The POST /api/chat/completions endpoint processes an image_url.url field. When this field contains a value that is not a standard URL (i.e., does not start with http://, https://, or data:image/), the backend interprets it as a file ID.

The core of the vulnerability lies in the get_image_base64_from_url function located in backend/open_webui/utils/files.py. This function is called by the convert_url_images_to_base64 middleware. When handling a file ID, get_image_base64_from_url calls Files.get_file_by_id to retrieve the file from the database. Crucially, this lookup does not perform any ownership or access control checks. As a result, any authenticated user can supply a file ID belonging to another user and gain unauthorized access to that file's contents.

The exploit scenario is as follows:

An attacker, authenticated as User B, obtains a file ID for a file uploaded by User A.
The attacker sends a request to the /api/chat/completions endpoint, including the victim's file ID in the image_url.url field.
The convert_url_images_to_base64 middleware processes this request and calls get_image_base64_from_url.
get_image_base64_from_url retrieves User A's file from storage, bypassing all authorization checks.
The file's content is then base64-encoded and can be exfiltrated, for instance, by prompting a vision-enabled LLM to describe the content of the "image."

This vulnerability allows any authenticated user to read files belonging to any other user on the platform, leading to a significant breach of data confidentiality. The fix requires passing the user context down to the file retrieval functions and implementing proper authorization checks to ensure that a user can only access files they own or have explicit permission to view.

Vulnerable functions

convert_url_images_to_base64

backend/open_webui/utils/middleware.py

This function initiates the vulnerable process. It takes the user-provided `image_url` and passes it to `get_image_base64_from_url` without proper validation of file ownership when the URL is a local file ID. The fix involves passing the user object to the downstream function to enable access control checks.

get_image_base64_from_url

backend/open_webui/utils/files.py

This function contains the core of the vulnerability. It directly calls `Files.get_file_by_id(url)` using the provided ID without verifying if the requesting user has permission to access the file. This allows any authenticated user to retrieve any file by its ID. The patch replaces the insecure call with `Files.get_file_by_id_and_user_id`, which enforces ownership checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.