Open WebUI: Open WebUI Vulnerable to Arbitrary File Upload and Path Traversal
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-44566
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, when attaching files to a promp, the name of the file is derived from the original HTTP upload request and is not validated or sanitized. This allows for users to upload files with names containing dot-segments in the file path and traverse out of the intended uploads directory. Effectively, users can upload files anywhere on the filesystem the user running the web server has permission. This vulnerability is fixed in 0.1.124.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat interface that your organization can run on its own server to use AI language models, even fully offline. This flaw affects versions before 0.1.124, in the part of the product that lets you attach files to a chat message. The name of an attached file is not checked, so a user can give a file a specially crafted name that places it outside the normal uploads folder. In effect, that user can save files anywhere on the server that the account running Open WebUI is allowed to write to. This flaw is rated Critical.
What to do
- If someone in your organization installed and runs Open WebUI, that person should act. If an IT provider or vendor runs it for you, they should act instead.
- Find out which version of Open WebUI you are running. Any version before
0.1.124has this flaw. - Update Open WebUI to version
0.1.124or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.