CVE-2026-28788: Open WebUI File Overwrite Vulnerability
Open WebUI
A missing ownership check in Open WebUI's file batch processing endpoint allowed authenticated users to overwrite arbitrary files in shared knowledge bases. The manipulated files could subsequently poison RAG responses provided to LLM users.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
- CVSS
- 7.1
- EPSS
- 0.03 · top 13% · 2026-11-13
- fix status
- Fix status unknown
- first report
- 27 Mar 2026
- last update
- 27 Mar 2026
- CVE ids
Timeline · 2
Sources · 2
Advisories and databases
- 2026-03-27CVE-2026-28788: Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwriteGitHub Advisory Database · github.com/advisories/GHSA-jjp7-g2jw-wh3j
- 2026-03-27CVE-2026-28788: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.NVD · nvd.nist.gov/vuln/detail/CVE-2026-28788
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Patch now
- AI role
- Attack on AI
- categories
- Infrastructure vulnerabilityData poisoning
- severity
- 2 · Disclosed vulnerability
- fix status
- Fix status unknown
- targets
- Framework / tooling
- owasp llm top 10
- LLM03:2025 Supply ChainLLM04:2025 Data and Model Poisoning
- mitre atlas
- no technique for these categories
- tags
- open-webuirag
- dates
- happened 27 Mar 2026 · first reported 27 Mar 2026
- origin
- GitHub Advisory DatabaseVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- record
- confidence 0.95 · created 2026-10-18 07:00Z · updated 2026-10-18 10:04Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CVE-2026-28788: Open WebUI File Overwrite Vulnerability https://gcdradar.vercel.app/incidents/cve-2026-28788-open-webui-file-overwrite-vulnerability · AIR-2026-0526 · closed 2026-03-27 - Lane: Patch now - Severity: 2 (Disclosed vulnerability) - Fix status: Fix status unknown - First reported: 2026-03-27 - AI role: Attack on AI - Products: Open WebUI - CVE ids: CVE-2026-28788 - CVSS: 7.1 ## Summary A missing ownership check in Open WebUI's file batch processing endpoint allowed authenticated users to overwrite arbitrary files in shared knowledge bases. The manipulated files could subsequently poison RAG responses provided to LLM users. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-03-27: CVE-2026-28788: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. (https://nvd.nist.gov/vuln/detail/CVE-2026-28788) - 2026-03-27: CVE-2026-28788: Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite (https://github.com/advisories/GHSA-jjp7-g2jw-wh3j) ## Sources - 2026-03-27 GitHub Advisory Database: CVE-2026-28788: Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite https://github.com/advisories/GHSA-jjp7-g2jw-wh3j - 2026-03-27 NVD: CVE-2026-28788: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. https://nvd.nist.gov/vuln/detail/CVE-2026-28788 Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closed8.1Open WebUI CVE-2026-44554: Open WebUI Vulnerable to RAG Poisoning via Collection Overwrite
Patch now · Disclosed · since 8 May 2026 · updated 15 May 2026 · CVE-2026-44554
AI - closed4.3Open WebUI CVE-2026-34225: Open WebUI blind SSRF in image edit functionality
Patch now · Disclosed · since 7 Jul 2026 · updated 7 Jul 2026 · CVE-2026-34225
AI - closed7.7Open WebUI CVE-2026-34222: Open WebUI Broken Access Control in Tool Valves
Patch now · Disclosed · since 1 Apr 2026 · CVE-2026-34222
AI - closed5.4Open WebUI CVE-2026-29070: Open WebUI unauthorized deletion of knowledge files
Patch now · Disclosed · since 27 Mar 2026 · CVE-2026-29070
AI - closed4.3Open WebUI CVE-2026-28786: Open WebUI vulnerable to path traversal in audio endpoint
Patch now · Disclosed · since 27 Mar 2026 · CVE-2026-28786
AI - closed3.1Open WebUI CVE-2026-29071: Open WebUI IDOR allows access to other users' memories
Patch now · Disclosed · since 27 Mar 2026 · CVE-2026-29071
AI