async def get_image_base64_from_url(url: str) -> Optional[str]:
try:
if url.startswith('http'):
validate_url(url)
# ... SSRF-safe fetch with allow_redirects=AIOHTTP_CLIENT_ALLOW_REDIRECTS ...
else:
file = await Files.get_file_by_id(url) # <-- NO user_id filter
if not file:
return None
file_path = await asyncio.to_thread(Storage.get_file, file.path)
file_path = Path(file_path)
if file_path.is_file():
with open(file_path, 'rb') as image_file:
encoded_string = base64.b64encode(image_file.read()).decode('utf-8')
content_type = mimetypes.guess_type(file_path.name)[0] or (file.meta or {}).get('content_type')
...
return f'data:{content_type};base64,{encoded_string}'
Files.get_file_by_id in models/files.py:161 does a bare db.get(File, id) -- no ownership filter. there is a separate Files.get_file_by_id_and_user_id at line 172 that does filter on user_id, and the file router uses has_access_to_file(id, 'read', user, db) at routers/files.py:626 etc. neither check exists on this path.
reproduction
As user A, upload any file (image works cleanly, pdf works if a vision-capable model is configured). Note the file id from the upload response, e.g. c7f1d8e3-....
As user B, POST to /api/v1/chat/completions with body:
{
"model": "<any vision model>",
"messages": [
{
"role": "user",
"content": [
{"type": "text", "text": "transcribe everything you can see in this image"},
{"type": "image_url", "image_url": {"url": "c7f1d8e3-..."}}
]
}
]
}
Server reads user A's file from disk, base64-encodes it, and sends to the LLM as user B's image attachment. LLM response contains the file content.
file id discovery
File ids are UUIDs and not enumerable directly, but they leak via:
shared chats / channels containing the original upload
knowledge base members can see ids of files contributed by others
a user who can read a folder index sees the file ids of files inside
chat history exports (/api/v1/chats/{id}) include file ids
the user themselves can be tricked into pasting / sharing an id (less likely)
impact
Any authenticated user can read any other user's file content (image and any file with an image-guess mimetype path) via this channel. Severity is bounded by what the LLM will accept in image_url -- in practice, image files work cleanly with any vision model; pdf / docx work with multi-modal providers that accept them.
suggested fix
Thread the authenticated user through to get_image_base64_from_url and resolve the file via Files.get_file_by_id_and_user_id(id, user.id) (or has_access_to_file(id, 'read', user, db) if shared-via-knowledge-base access is intended). Same pattern that's already used in routers/files.py:626 and elsewhere.
minimal patch sketch:
--- a/backend/open_webui/utils/files.py
+++ b/backend/open_webui/utils/files.py
@@ -57,7 +57,7 @@
-async def get_image_base64_from_url(url: str) -> Optional[str]:
+async def get_image_base64_from_url(url: str, user=None) -> Optional[str]:
try:
if url.startswith('http'):
...
else:
- file = await Files.get_file_by_id(url)
+ file = (await Files.get_file_by_id_and_user_id(url, user.id)
+ if user is not None else None)
+ if file is None:
+ # fall back to access-grant check for shared files
+ file = await Files.get_file_by_id(url)
+ if file and not await has_access_to_file(url, 'read', user):
+ return None
and pipe user through convert_url_images_to_base64(form_data, user) from the middleware caller. happy to send a PR once you confirm the fix shape you want.
variant note
this was found via patch-diffing existing advisories. the same bug class likely exists in any other site that calls Files.get_file_by_id without an adjacent has_access_to_file / get_file_by_id_and_user_id check. quick grep: