Bl4Ckr0Ss3

**Name of the Vulnerable Software and Affected Versions** Open-webui (affected versions not specified) **Description** An authenticated user can access files belonging to other users by exploiting a lack of ownership verification in the image processing path. When the `POST` endpoint "/api/chat/completions" receives an `image url.url` value that does not start with `http://`, `https://`, or `data:image/`, the system interprets the value as a file ID and retrieves the file from the global table without checking if the requesting user has the necessary permissions. This occurs within the `convert url images to base64()` function, which calls `get image base64 from url()` without passing the user's identity. Consequently, an attacker can provide another user's file ID in the `url` variable, causing the server to read the file from disk, base64-encode it, and inject it into the Large Language Model (LLM) request. The attacker can then prompt the LLM to describe or perform Optical Character Recognition (OCR) on the file to retrieve its contents. This issue affects image files and other documents (such as PDF or DOCX) if the used LLM provider supports multi-modal inputs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.