Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts an image_url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. an authenticated user can therefore set image_url.url to another user's file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. the user then prompts the LLM to describe / OCR the file and reads the content back. This vulnerability is fixed in 0.9.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-19 | 1 | General1 |
| 2026-06-23 | 1 | Disclosure1 |
> random scrolling on github > open all notifs > realize I got CVE from last month CVE-2026-54009 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N https://github.com/open-webui/open-webui/security/advisories/GHSA-wch8-mhj5-9frg
Post summary
The text shares a CVE with its CVSS score and a link to a GitHub advisory, but offers no PoC, exploit, active exploitation, or patch details.
CVE-2026-54009 Unauthorized File Access via Image URL Parameter in Open WebUI Before 0.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54009 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The text announces the discovery of CVE‑2026‑54009, an unauthorized file access vulnerability in Open WebUI triggered by an image URL parameter.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |