Open WebUI CVE-2025-70487: Cross-User File Disclosure via Inline Model Knowledge Metadata

Cross-User File Content Disclosure via Request-Scoped Inline Model Knowledge Metadata Vulnerability Summary Open WebUI allows users to define an inline model within a chat request, rather than selecting a saved workspace model. Knowledge attached to such an inline model is used as-is, without verifying whether the caller has permission to read the content it references. An attacker who knows another user's file ID can exploit the built-in knowledge tool to return the indexed content of that file. Affected Versions Affected versions: >= 0.8.8, = 0.11.0 Remediation The vulnerability was fixed in version 0.11.0 via commit . Knowledge attached to inline models is now filtered based on the caller's read access permissions; files, knowledge bases, or nodes that cannot be read by the caller are discarded. A full upgrade resolves the issue without requiring any configuration changes. Root Cause The affected components include the chat completion and chat action endpoints, which accept inline model definitions and consume the attached model knowledge. The affected configuration applies to all builds from 0.8.8 to 0.10.2. When a saved workspace model is created, updated, or imported, it validates the author of the referenced files. Consequently, stored models can only carry files that their creator has read access to. Inline models bypass this validation path. Subsequent processing treats their attached knowledge identically to that of stored models, including an assistant that grants read access to files solely because the running model claims the knowledge is attached. The missing control is an access checkpoint when client-provided model metadata enters the request. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None CVE ID: CVE-2025-70487 Weakness: CWE-862 Reporter: @whyiug Fix Developer: Classic268

Goal Reached Thanks to every supporter — we hit 100%!

Open WebUI CVE-2025-70487: Cross-User File Disclosure via Inline Model Knowledge Metadata

More from this source