Executive brief
Open WebUI, an interface for interacting with large language models, is vulnerable to a flaw that allows users to delete files on the server. By uploading a specially named file, an attacker can overwrite and then automatically delete critical system or application files. This can lead to a complete disruption of service or loss of important data.
Technical details
A path traversal vulnerability exists in the '/ollama/models/upload' API route of Open WebUI. The application fails to sanitize the 'filename' parameter from multipart/form-data uploads, using it directly to construct a local file path. An authenticated attacker can use dot-segment sequences (e.g., ../) to save an uploaded file to an arbitrary location. Because the application logic automatically calls os.remove() on the file path after attempting to process the upload, this results in the deletion of any file the web server process has permissions to modify. The vulnerability is present in versions up to 0.6.9 and is fixed in version 0.6.10.
Affected products
- Open WebUI Open WebUI <= 0.6.9
Timeline
- 2024-06-11: disclosed: Vulnerability submitted by discoverer.
- 2026-05-11: advisory: GitHub Advisory published.
- 2026-05-11: patched: Version 0.6.10 released.
References
- https://api.github.com/users/KoreLogicSecurityDisclosures
- https://github.com/KoreLogicSecurityDisclosures
- https://api.github.com/users/KoreLogicSecurityDisclosures/gists%7B/gist_id%7D
- https://api.github.com/users/KoreLogicSecurityDisclosures/repos
- https://avatars.githubusercontent.com/u/163048701?v=4
- https://api.github.com/users/KoreLogicSecurityDisclosures/events%7B/privacy%7D