https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 05:53:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-348527 EUVD-2026-348527 https://cve.radiocsirt.org/vuln/euvd-2026-348527 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70488 <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base. A user with write access to one knowledge base could delete directories and remove file embeddings from another knowledge base, causing documents to drop out of retrieval results and breaking chat-with-file for targeted documents without disclosing contents. This issue is fixed in 0.11.0.</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base. A user with write access to one knowledge base could delete directories and remove file embeddings from another knowledge base, causing documents to drop out of retrieval results and breaking chat-with-file for targeted documents without disclosing contents. This issue is fixed in 0.11.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-70488 https://cve.radiocsirt.org/vuln/ghsa-jxc9-xmc4-gr23 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base.</p> <p>## Preconditions Default configuration, no flags involved. The attacker needs write access to at least one knowledge base, which comes from owning one, from a write access grant, or from the admin role; `workspace.knowledge` is off by default, so an ordinary user cannot simply create one. They also need the victim&#39;s directory or file id, which are UUIDs and are not enumerable, so in practice the attacker is someone who can already see the target knowledge base, typically a read-only collaborator on a shared one. Deployments where no knowledge base is shared beyond its owner are not reachable.</p> <p>## Impact The attacker deletes a target directory and, because the deletion runs without moving files to the parent, the knowledge_file associations for every file in that subtree are removed as well, so those documents silently drop out of the victim&#39;s knowledge base and out of its retrieval results. Separately, the per-file vector cleanup dropped the standalone `file-&lt;id&gt;` collection for any file id, breaking chat-with-file for that document. The stored files and their database rows survive, since th…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base.</p> <p>## Preconditions Default configuration, no flags involved. The attacker needs write access to at least one knowledge base, which comes from owning one, from a write access grant, or from the admin role; `workspace.knowledge` is off by default, so an ordinary user cannot simply create one. They also need the victim&#39;s directory or file id, which are UUIDs and are not enumerable, so in practice the attacker is someone who can already see the target knowledge base, typically a read-only collaborator on a shared one. Deployments where no knowledge base is shared beyond its owner are not reachable.</p> <p>## Impact The attacker deletes a target directory and, because the deletion runs without moving files to the parent, the knowledge_file associations for every file in that subtree are removed as well, so those documents silently drop out of the victim&#39;s knowledge base and out of its retrieval results. Separately, the per-file vector cleanup dropped the standalone `file-&lt;id&gt;` collection for any file id, breaking chat-with-file for that document. The stored files and their database rows survive, since th…</p> https://cve.radiocsirt.org/vuln/ghsa-jxc9-xmc4-gr23 https://cve.radiocsirt.org/vuln/pysec-2026-3648 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base.</p> <p>## Preconditions Default configuration, no flags involved. The attacker needs write access to at least one knowledge base, which comes from owning one, from a write access grant, or from the admin role; `workspace.knowledge` is off by default, so an ordinary user cannot simply create one. They also need the victim&#39;s directory or file id, which are UUIDs and are not enumerable, so in practice the attacker is someone who can already see the target knowledge base, typically a read-only collaborator on a shared one. Deployments where no knowledge base is shared beyond its owner are not reachable.</p> <p>## Impact The attacker deletes a target directory and, because the deletion runs without moving files to the parent, the knowledge_file associations for every file in that subtree are removed as well, so those documents silently drop out of the victim&#39;s knowledge base and out of its retrieval results. Separately, the per-file vector cleanup dropped the standalone `file-&lt;id&gt;` collection for any file id, breaking chat-with-file for that document. The stored files and their database rows survive, since th…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied in the request body without checking that those objects belonged to that knowledge base.</p> <p>## Preconditions Default configuration, no flags involved. The attacker needs write access to at least one knowledge base, which comes from owning one, from a write access grant, or from the admin role; `workspace.knowledge` is off by default, so an ordinary user cannot simply create one. They also need the victim&#39;s directory or file id, which are UUIDs and are not enumerable, so in practice the attacker is someone who can already see the target knowledge base, typically a read-only collaborator on a shared one. Deployments where no knowledge base is shared beyond its owner are not reachable.</p> <p>## Impact The attacker deletes a target directory and, because the deletion runs without moving files to the parent, the knowledge_file associations for every file in that subtree are removed as well, so those documents silently drop out of the victim&#39;s knowledge base and out of its retrieval results. Separately, the per-file vector cleanup dropped the standalone `file-&lt;id&gt;` collection for any file id, breaking chat-with-file for that document. The stored files and their database rows survive, since th…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3648