CVE-2026-54009

Name of the Vulnerable Software and Affected Versions Open-webui (affected versions not specified)

Description An authenticated user can access files belonging to other users by exploiting a lack of ownership verification in the image processing path. When the POST endpoint "/api/chat/completions" receives an image url.url value that does not start with http://, https://, or data:image/, the system interprets the value as a file ID and retrieves the file from the global table without checking if the requesting user has the necessary permissions. This occurs within the convert url images to base64() function, which calls get image base64 from url() without passing the user's identity. Consequently, an attacker can provide another user's file ID in the url variable, causing the server to read the file from disk, base64-encode it, and inject it into the Large Language Model (LLM) request. The attacker can then prompt the LLM to describe or perform Optical Character Recognition (OCR) on the file to retrieve its contents. This issue affects image files and other documents (such as PDF or DOCX) if the used LLM provider supports multi-modal inputs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.