https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:21:36 +0000 https://vulnerability.circl.lu/vuln/cve-2026-54010 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has_access_to_file() treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file. This vulnerability is fixed in 0.9.6.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has_access_to_file() treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file. This vulnerability is fixed in 0.9.6.</p> https://vulnerability.circl.lu/vuln/cve-2026-54010 https://vulnerability.circl.lu/vuln/ghsa-vrhc-3fr6-pc3c <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Open WebUI `v0.9.5` lets an authenticated user attach arbitrary `file_id` values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, `has_access_to_file()` treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file.</p> <p>## Impact</p> <p>Security boundary crossed: file confidentiality and integrity.</p> <p>An authenticated attacker who knows or obtains a victim `file_id` can make Open WebUI authorize, through an attacker-owned shared chat:</p> <p>- reading the victim file via `GET /api/v1/files/{id}/content`, and - deleting the victim file via `DELETE /api/v1/files/{id}`.</p> <p>## Root Cause</p> <p>Client-controlled message file IDs are persisted without file authorization checks:</p> <p>```python # backend/open_webui/main.py await Chats.insert_chat_files( chat_id, user_message.get(&#39;id&#39;), [ file_item.get(&#39;id&#39;) for file_item in user_message_files if file_item.get(&#39;type&#39;) == &#39;file&#39; ], user.id, ) ```</p> <p>`insert_chat_files()` stores the provided IDs directly:</p> <p>```python # backend/open_webui/models/chats.py ChatFileModel( user_id=user_id, chat_id=chat_id, message_id=message_id, file_id=file_id, ) ```</p> <p>Later, file authorization trusts shared-chat associations:</p> <p>```python # backend/open_webui/utils/access_control/files.py shared_chat_ids = await Chats.get_shared_chat_ids_by_file_id(file_id,…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary</p> <p>Open WebUI `v0.9.5` lets an authenticated user attach arbitrary `file_id` values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, `has_access_to_file()` treats the victim file as accessible through the shared chat, and the file endpoints read or delete the victim file.</p> <p>## Impact</p> <p>Security boundary crossed: file confidentiality and integrity.</p> <p>An authenticated attacker who knows or obtains a victim `file_id` can make Open WebUI authorize, through an attacker-owned shared chat:</p> <p>- reading the victim file via `GET /api/v1/files/{id}/content`, and - deleting the victim file via `DELETE /api/v1/files/{id}`.</p> <p>## Root Cause</p> <p>Client-controlled message file IDs are persisted without file authorization checks:</p> <p>```python # backend/open_webui/main.py await Chats.insert_chat_files( chat_id, user_message.get(&#39;id&#39;), [ file_item.get(&#39;id&#39;) for file_item in user_message_files if file_item.get(&#39;type&#39;) == &#39;file&#39; ], user.id, ) ```</p> <p>`insert_chat_files()` stores the provided IDs directly:</p> <p>```python # backend/open_webui/models/chats.py ChatFileModel( user_id=user_id, chat_id=chat_id, message_id=message_id, file_id=file_id, ) ```</p> <p>Later, file authorization trusts shared-chat associations:</p> <p>```python # backend/open_webui/utils/access_control/files.py shared_chat_ids = await Chats.get_shared_chat_ids_by_file_id(file_id,…</p> https://vulnerability.circl.lu/vuln/ghsa-vrhc-3fr6-pc3c