https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 21:56:07 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07137 bdu:2026-07137 https://cve.radiocsirt.org/vuln/bdu:2026-07137 https://cve.radiocsirt.org/vuln/euvd-2026-319366 EUVD-2026-319366 https://cve.radiocsirt.org/vuln/euvd-2026-319366 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45301 <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.3.16, a missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform. This vulnerability is fixed in 0.3.16.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45301 https://cve.radiocsirt.org/vuln/ghsa-r8wh-8m7r-fh33 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.</p> <p>### Details All `files/` related endpoints lack permission checks.</p> <p>#### Listing all files For example, let&#39;s see how file listing is implemented: https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110 https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26 Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files&#39; `user_id` to the requesting user.</p> <p>This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions: #### Accessing the content of any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193 #### Deleting any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241</p> <p>### PoC #### Configuration 1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop: `docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.</p> <p>### Details All `files/` related endpoints lack permission checks.</p> <p>#### Listing all files For example, let&#39;s see how file listing is implemented: https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110 https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26 Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files&#39; `user_id` to the requesting user.</p> <p>This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions: #### Accessing the content of any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193 #### Deleting any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241</p> <p>### PoC #### Configuration 1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop: `docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-…</p> https://cve.radiocsirt.org/vuln/ghsa-r8wh-8m7r-fh33 https://cve.radiocsirt.org/vuln/pysec-2026-2753 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.</p> <p>### Details All `files/` related endpoints lack permission checks.</p> <p>#### Listing all files For example, let&#39;s see how file listing is implemented: https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110 https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26 Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files&#39; `user_id` to the requesting user.</p> <p>This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions: #### Accessing the content of any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193 #### Deleting any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241</p> <p>### PoC #### Configuration 1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop: `docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary A missing permission check in all files related API endpoints allows any authenticated user to list, access and delete every file uploaded by every user to the platform.</p> <p>### Details All `files/` related endpoints lack permission checks.</p> <p>#### Listing all files For example, let&#39;s see how file listing is implemented: https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L107-L110 https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/models/files.py#L26 Notice the endpoint depends only on an authenticated user check, no file filtering is done to match the uploaded files&#39; `user_id` to the requesting user.</p> <p>This problem repeats itself throughout the various route implementations, allowing any user to perform actions on any file. Some note worthy functions: #### Accessing the content of any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L173-L193 #### Deleting any file https://github.com/open-webui/open-webui/blob/e2b7296786053dfc77f6ae0205a1b195e05a712c/backend/apps/webui/routers/files.py#L224-L241</p> <p>### PoC #### Configuration 1. I ran a clean install of the latest version using one of the docker one-liners on an Ubuntu desktop: `docker run -d -p 3000:8080 -v ollama:/root/.ollama -v open-webui:/app/backend/data --name open-webui --restart always ghcr.io/open-webui/open-…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2753