PT-2026-56883 · Unknown · Open-Webui
CVE-2026-59217
·
Published
2026-07-09
·
Updated
2026-08-04
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Open WebUI versions prior to 0.10.0
Description
The file upload path fails to apply the necessary write-access checks when the
metadata.knowledge id variable is provided. This allows users with read-only permissions to bypass the security controls typically enforced by the '/api/v1/knowledge//file/add' endpoint and add arbitrary files to a target knowledge base.Recommendations
Update to version 0.10.0.
Exploit
Fix
DoS
Missing Authorization
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Open-Webui