{"items":[{"id":"NVI-00016210","kind":"vulnerability","title":"Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-wch8-mhj5-9frg","CVE-2026-54009"],"plain_summary":"GitHub lists this reviewed advisory for open-webui. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-61be2c75ff14f389571534c7f917e658"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:03:48.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-49082c7e9c496cdd553f6b52ad3640bc"},{"kind":"CVSS","as_of":"2026-06-25T13:35:03.573Z","value":"6.5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-61be2c75ff14f389571534c7f917e658"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-49082c7e9c496cdd553f6b52ad3640bc","url":"https://github.com/advisories/GHSA-wch8-mhj5-9frg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wch8-mhj5-9frg","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"},{"id":"sr-61be2c75ff14f389571534c7f917e658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54009","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-54009","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T01:48:12.360Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-49082c7e9c496cdd553f6b52ad3640bc"],"technology":"open-webui","known_exclusions":[],"conditions_summary":"## summary\n\n`POST /api/chat/completions` accepts an `image_url.url` value that, when it does NOT start with `http://`, `https://`, or `data:image/`, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set `image_url.url` to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. The user then prompts the LLM to describe / OCR the file and reads the content back.\n\nSame class as CVE-2026-44560 (RAG cross-user access) and the multiple `has_access_to_file` checks added in `routers/files.py` -- the auth boundary was tightened on the file router but not on this conversion path.\n\n## affected code\n\n`backend/open_webui/utils/middleware.py:2113-2150` -- `convert_url_images_to_base64`:\n\n```python\nasync def convert_url_images_to_base64(form_data):\n    messages = form_data.get('messages', [])\n    for message in messages:\n        content = message.get('content')\n        if not isinstance(content, list):\n            continue\n        new_content = []\n        for item in content:\n            if not isinstance(item, dict) or item.get('type') != 'imag","public_affected_ranges":["<= 0.9.5"]}],"null_published_at":"2026-11-08T19:53:44.062Z","source_updated_at":"2026-07-20T21:03:48.000Z","source_disclosed_at":"2026-06-17T14:11:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-04T02:47:44.783Z"},{"id":"NVI-00016210","kind":"vulnerability","title":"Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wch8-mhj5-9frg","CVE-2026-54009"],"plain_summary":"GitHub lists this reviewed advisory for open-webui. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-49082c7e9c496cdd553f6b52ad3640bc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:03:48.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-49082c7e9c496cdd553f6b52ad3640bc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-49082c7e9c496cdd553f6b52ad3640bc","url":"https://github.com/advisories/GHSA-wch8-mhj5-9frg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wch8-mhj5-9frg","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T02:47:44.783Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-49082c7e9c496cdd553f6b52ad3640bc"],"technology":"open-webui","known_exclusions":[],"conditions_summary":"## summary\n\n`POST /api/chat/completions` accepts an `image_url.url` value that, when it does NOT start with `http://`, `https://`, or `data:image/`, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set `image_url.url` to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. The user then prompts the LLM to describe / OCR the file and reads the content back.\n\nSame class as CVE-2026-44560 (RAG cross-user access) and the multiple `has_access_to_file` checks added in `routers/files.py` -- the auth boundary was tightened on the file router but not on this conversion path.\n\n## affected code\n\n`backend/open_webui/utils/middleware.py:2113-2150` -- `convert_url_images_to_base64`:\n\n```python\nasync def convert_url_images_to_base64(form_data):\n    messages = form_data.get('messages', [])\n    for message in messages:\n        content = message.get('content')\n        if not isinstance(content, list):\n            continue\n        new_content = []\n        for item in content:\n            if not isinstance(item, dict) or item.get('type') != 'imag","public_affected_ranges":["<= 0.9.5"]}],"null_published_at":"2026-11-04T10:04:27.919Z","source_updated_at":"2026-07-20T21:03:48.000Z","source_disclosed_at":"2026-06-17T14:11:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T02:47:44.783Z"}],"next_cursor":null,"snapshot_revision":"42594"}