CVE-2026-70488: Open WebUI Path Traversal Vulnerability

CVE-2026-70488 Overview

CVE-2026-70488 is an authorization flaw in Open WebUI, a self-hosted AI platform. The vulnerability affects the knowledge base sync cleanup endpoint in versions 0.9.6 through 0.10.x. The endpoint verified write access to the knowledge base identified in the URL, but processed directory and file identifiers from the request body without validating ownership. An authenticated user with write access to one knowledge base could delete directories and remove file embeddings from another knowledge base. The result is document removal from retrieval results and broken chat-with-file functionality for targeted documents. Contents are not disclosed. The issue is classified as [CWE-639: Authorization Bypass Through User-Controlled Key] and is fixed in version 0.11.0.

Critical Impact
Authenticated users can tamper with knowledge bases they do not own, silently disrupting Retrieval-Augmented Generation (RAG) workflows and chat-with-file features.

Affected Products

Open WebUI versions 0.9.6 through 0.10.x
Self-hosted AI deployments using the knowledge base sync feature
Fixed in Open WebUI 0.11.0

Discovery Timeline

2026-08-04 - CVE-2026-70488 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70488

Vulnerability Analysis

The flaw resides in the knowledge sync cleanup route in backend/open_webui/routers/knowledge.py. The endpoint accepts a knowledge base identifier through the URL path and a list of file and directory identifiers in the request body. Authorization checks are performed only on the URL-supplied knowledge base identifier. The handler then iterates over the body-supplied identifiers and calls deletion routines without confirming those identifiers belong to the authorized knowledge base. This mismatch between the authorization scope and the operation scope enables cross-tenant tampering.

Root Cause

The root cause is an insecure direct object reference (IDOR) pattern [CWE-639]. The application trusts client-supplied object identifiers without verifying that each identifier is a child of the parent resource being authorized. Any authenticated user with write access to a single knowledge base becomes an implicit editor of every other knowledge base through request-body substitution.

Attack Vector

Exploitation requires an authenticated account with write access to at least one knowledge base. The attacker issues a sync cleanup request that references their own knowledge base in the URL, but supplies file_id and directory identifiers belonging to a victim knowledge base in the body. The server removes file embeddings and deletes directory entries from the victim's knowledge base. Targeted documents disappear from retrieval results, breaking chat-with-file interactions without leaking document contents.

python

         if not file:
             continue
 
+        # Only clean up files that belong to this knowledge base.
+        if not await Knowledges.has_file(id, file_id, db=db):
+            continue
+
         await Knowledges.remove_file_from_knowledge_by_id(id, file_id, db=db)

         try:

Source: Open WebUI security patch commit 707efea. The patch adds a Knowledges.has_file(id, file_id, db=db) check that skips any file_id not belonging to the target knowledge base id.

Detection Methods for CVE-2026-70488

Indicators of Compromise

Unexplained removals of files or directories from knowledge bases, particularly documents disappearing from Retrieval-Augmented Generation (RAG) results.
HTTP requests to the knowledge sync cleanup endpoint where the file or directory identifiers in the request body do not match the knowledge base identifier in the URL.
Chat-with-file failures for previously indexed documents without a corresponding administrator action in audit logs.
Elevated volume of remove_file_from_knowledge_by_id operations originating from non-owner user accounts.

Detection Strategies

Correlate application logs with knowledge base ownership metadata to identify deletion operations issued by non-owners.
Instrument the sync cleanup endpoint to log the URL knowledge base identifier alongside all body-supplied file and directory identifiers for retrospective analysis.
Alert on any single user account touching file identifiers across multiple distinct knowledge bases within a short window.

Monitoring Recommendations

Forward Open WebUI application and reverse proxy logs to a centralized log platform and retain them for at least 90 days.
Monitor the /knowledge/{id}/files/sync route family for anomalous request payload sizes and cross-tenant identifier references.
Track knowledge base file counts and embedding counts over time to surface unexpected drops.

How to Mitigate CVE-2026-70488

Immediate Actions Required

Upgrade Open WebUI to version 0.11.0 or later, which contains the authorization fix in commit 707efea.
Audit knowledge base contents for missing files or directories and restore from backup where required.
Review recent activity from all accounts with write access to any knowledge base and revoke access for accounts that are no longer needed.
Rotate API tokens issued to Open WebUI users following the upgrade.

Patch Information

The fix is available in Open WebUI release v0.11.0. The change is tracked in Pull Request #26722 and detailed in GitHub Security Advisory GHSA-jxc9-xmc4-gr23. The patch scopes sync cleanup deletions to the target knowledge base by verifying file ownership with Knowledges.has_file before removal.

Workarounds

Restrict write access to knowledge bases to trusted administrators until the upgrade is applied.
Block or rate-limit the knowledge sync cleanup endpoint at the reverse proxy for non-administrative users.
Maintain regular backups of the knowledge base database and embedding stores to enable rapid recovery from tampering.

bash

# Upgrade Open WebUI to the patched release
docker pull ghcr.io/open-webui/open-webui:v0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:v0.11.0