PT-2026-50481 · Pypi · Open-Webui
Publicado
2026-06-17
·
Atualizado
2026-06-17
·
CVE-2026-54009
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
summary
POST /api/chat/completions accepts an image url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set image url.url to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. The user then prompts the LLM to describe / OCR the file and reads the content back.Same class as CVE-2026-44560 (RAG cross-user access) and the multiple
has access to file checks added in routers/files.py -- the auth boundary was tightened on the file router but not on this conversion path.affected code
backend/open webui/utils/middleware.py:2113-2150 -- convert url images to base64:python
async def convert url images to base64(form data):
messages = form data.get('messages', [])
for message in messages:
content = message.get('content')
if not isinstance(content, list):
continue
new content = []
for item in content:
if not isinstance(item, dict) or item.get('type') != 'image url':
new content.append(item)
continue
image url = item.get('image url', {}).get('url', '')
if image url.startswith('data:image/'):
new content.append(item)
continue
try:
base64 data = await get image base64 from url(image url) # <-- no `user` passed
if base64 data:
new content.append({'type': 'image url',
'image url': {'url': base64 data}})called from the main chat completion middleware at
middleware.py:2357:python
form data = await convert url images to base64(form data)backend/open webui/utils/files.py:57-95 -- get image base64 from url:python
async def get image base64 from url(url: str) -> Optional[str]:
try:
if url.startswith('http'):
validate url(url)
# ... SSRF-safe fetch with allow redirects=AIOHTTP CLIENT ALLOW REDIRECTS ...
else:
file = await Files.get file by id(url) # <-- NO user id filter
if not file:
return None
file path = await asyncio.to thread(Storage.get file, file.path)
file path = Path(file path)
if file path.is file():
with open(file path, 'rb') as image file:
encoded string = base64.b64encode(image file.read()).decode('utf-8')
content type = mimetypes.guess type(file path.name)[0] or (file.meta or {}).get('content type')
...
return f'data:{content type};base64,{encoded string}'Files.get file by id in models/files.py:161 does a bare db.get(File, id) -- no ownership filter. there is a separate Files.get file by id and user id at line 172 that does filter on user id, and the file router uses has access to file(id, 'read', user, db) at routers/files.py:626 etc. neither check exists on this path.reproduction
- As user A, upload any file (image works cleanly, pdf works if a vision-capable model is configured). Note the file id from the upload response, e.g.
c7f1d8e3-.... - As user B, POST to
/api/v1/chat/completionswith body:
json
{
"model": "<any vision model>",
"messages": [
{
"role": "user",
"content": [
{"type": "text", "text": "transcribe everything you can see in this image"},
{"type": "image url", "image url": {"url": "c7f1d8e3-..."}}
]
}
]
}Server reads user A's file from disk, base64-encodes it, and sends to the LLM as user B's image attachment. LLM response contains the file content.
file id discovery
File ids are UUIDs and not enumerable directly, but they leak via:
- shared chats / channels containing the original upload
- knowledge base members can see ids of files contributed by others
- a user who can read a folder index sees the file ids of files inside
- chat history exports (
/api/v1/chats/{id}) include file ids - the user themselves can be tricked into pasting / sharing an id (less likely)
impact
Any authenticated user can read any other user's file content (image and any file with an image-guess mimetype path) via this channel. Severity is bounded by what the LLM will accept in
image url -- in practice, image files work cleanly with any vision model; pdf / docx work with multi-modal providers that accept them.suggested fix
Thread the authenticated user through to
get image base64 from url and resolve the file via Files.get file by id and user id(id, user.id) (or has access to file(id, 'read', user, db) if shared-via-knowledge-base access is intended). Same pattern that's already used in routers/files.py:626 and elsewhere.minimal patch sketch:
diff
--- a/backend/open webui/utils/files.py
+++ b/backend/open webui/utils/files.py
@@ -57,7 +57,7 @@
-async def get image base64 from url(url: str) -> Optional[str]:
+async def get image base64 from url(url: str, user=None) -> Optional[str]:
try:
if url.startswith('http'):
...
else:
- file = await Files.get file by id(url)
+ file = (await Files.get file by id and user id(url, user.id)
+ if user is not None else None)
+ if file is None:
+ # fall back to access-grant check for shared files
+ file = await Files.get file by id(url)
+ if file and not await has access to file(url, 'read', user):
+ return Noneand pipe
user through convert url images to base64(form data, user) from the middleware caller. happy to send a PR once you confirm the fix shape you want.variant note
this was found via patch-diffing existing advisories. the same bug class likely exists in any other site that calls
Files.get file by id without an adjacent has access to file / get file by id and user id check. quick grep:git grep -n 'Files.get file by id(' -- 'backend/open webui/**'worth a sweep across utils/ and routers/ for missed sites.
environment
Open-webui main branch as of commit
3660bc0 (2026-05-10). python 3.x backend. confirmed by reading the source; no instance stood up.Correção
IDOR
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Open-Webui