CVE-2026-54009
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts an image_url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. an authenticated user can therefore set image_url.url to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. the user then prompts the LLM to describe / OCR the file and reads the content back. This vulnerability is fixed in 0.9.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
open-webuiPyPI | < 0.9.6 | 0.9.6 |
Affected products
2cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*range: <0.9.6
- (no CPE)range: <= 0.9.5
Patches
Vulnerability mechanics
References
5- github.com/open-webui/open-webui/security/advisories/GHSA-wch8-mhj5-9frgnvdExploitVendor AdvisoryMitigationWEB
- github.com/advisories/GHSA-wch8-mhj5-9frgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-54009ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2766.yamlghsaWEB
- pypi.org/project/open-webuighsaWEB
News mentions
1- Open WebUI: 16 CVEs Disclosed in Single-Day Batch, Many Bypassing Earlier PatchesVypr Intelligence · Jun 17, 2026