Executive brief
Open WebUI, an interface for interacting with large language models, is vulnerable to a flaw that allows attackers to upload files to any location on the server's storage. This could allow an unauthorized user to overwrite critical system files or plant malicious software, potentially leading to a full takeover of the server. The issue stems from a lack of validation when users attach files to their prompts.
Technical details
A path traversal vulnerability exists in the '/rag/api/v1/doc' API route of Open WebUI. The application fails to sanitize the 'filename' parameter provided in multipart form data during file uploads, allowing the use of dot-segment sequences (e.g., '../../'). An attacker can exploit this to traverse out of the intended upload directory and write files to arbitrary locations with the permissions of the web server user. This can lead to remote code execution by uploading malicious Python models (pickle objects) or overwriting sensitive files like SSH 'authorized_keys'. The vulnerability is patched in version 0.1.124.
Affected products
- Open WebUI Open WebUI <= 0.1.123
Timeline
- 2024-03-12: disclosed: Vulnerability submitted by KoreLogic, Inc.
- 2026-05-08: advisory: GitHub Advisory published.
- 2026-05-08: patched: Fix released in version 0.1.124.
References
- https://api.github.com/users/KoreLogicSecurityDisclosures
- https://github.com/KoreLogicSecurityDisclosures
- https://api.github.com/users/KoreLogicSecurityDisclosures/gists%7B/gist_id%7D
- https://api.github.com/users/KoreLogicSecurityDisclosures/repos
- https://avatars.githubusercontent.com/u/163048701?v=4
- https://api.github.com/users/KoreLogicSecurityDisclosures/events%7B/privacy%7D