CVE-2026-59217 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2026-59217

Modified

More Info Official Page

Source-security-advisories@github.com

Published At-09 Jul, 2026 | 17:17

Updated At-14 Jul, 2026 | 02:16

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and auto-linked uploaded files to a target knowledge base without applying the write-access check used by /api/v1/knowledge//file/add, allowing read-only knowledge-base users to add arbitrary files. This issue is fixed in version 0.10.0.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
			N/A

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

CPE Matches

openwebui>>open_webui>>Versions before 0.10.0(exclusive)

cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-862	Secondary	security-advisories@github.com
CWE-863	Secondary	security-advisories@github.com

CWE ID: CWE-862

Type: Secondary

Source: security-advisories@github.com

CWE ID: CWE-863

Type: Secondary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/open-webui/open-webui/commit/b7626f05fb92b24ab923ad81a037071ebd5623d1	security-advisories@github.com	Patch
https://github.com/open-webui/open-webui/pull/26001	security-advisories@github.com	Issue Tracking Patch
https://github.com/open-webui/open-webui/releases/tag/v0.10.0	security-advisories@github.com	Product Release Notes
https://github.com/open-webui/open-webui/security/advisories/GHSA-7r7x-gjvr-448g	security-advisories@github.com	Exploit Mitigation Vendor Advisory
https://github.com/open-webui/open-webui/security/advisories/GHSA-7r7x-gjvr-448g	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit Mitigation Vendor Advisory

Hyperlink: https://github.com/open-webui/open-webui/commit/b7626f05fb92b24ab923ad81a037071ebd5623d1

Source: security-advisories@github.com

Resource:

Patch

Hyperlink: https://github.com/open-webui/open-webui/pull/26001

Source: security-advisories@github.com

Resource:

Issue Tracking

Patch

Hyperlink: https://github.com/open-webui/open-webui/releases/tag/v0.10.0

Source: security-advisories@github.com

Resource:

Product

Release Notes

Hyperlink: https://github.com/open-webui/open-webui/security/advisories/GHSA-7r7x-gjvr-448g

Source: security-advisories@github.com

Resource:

Exploit

Mitigation

Vendor Advisory

Hyperlink: https://github.com/open-webui/open-webui/security/advisories/GHSA-7r7x-gjvr-448g

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

Exploit

Mitigation

Vendor Advisory