File Content Overwrite Vulnerability in Open WebUI by Open WebUI

CVE-2026-28788

What is CVE-2026-28788?

Prior to version 0.8.6, Open WebUI allows authenticated users to exploit a file content overwrite vulnerability. This issue arises from the lack of ownership checks in the POST /api/v1/retrieval/process/files/batch endpoint. An attacker can obtain file UUIDs through the GET /api/v1/knowledge/{id}/files endpoint, enabling them to overwrite file contents they should only have read access to. This could lead to the manipulation of information presented by the platform, as the altered content is subsequently served to the language model, giving the attacker control over the output delivered to other users.

References