Open WebUI Knowledge Base File Deletion Vulnerability

A vulnerability in Open WebUI prior to version 0.8.6 allows for unauthorized deletion of files from knowledge bases. The issue arises because the application fails to verify that a file being deleted actually belongs to the user's knowledge base. Instead, it only checks if the user has write access or is an admin. As a result, users can delete arbitrary files from any knowledge base, provided they know the file ID.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion from knowledge bases.

Reproduction

To reproduce this vulnerability, a user must have knowledge bases with files and create a collection. The user can then send a request to delete a file from a knowledge base that does not belong to them, using the file ID of a file in the victim's knowledge base. The request will be processed successfully, and the file will be deleted from the victim's knowledge base.

Remediation

Users are advised to update to Open WebUI version 0.8.6 or later, where this vulnerability has been patched.