Open WebUI erlaubt Remote Code Execution über Hochladen einer beliebigen Datei nach /audio/api/v1/transcriptions

The vulnerability lies in the /audio/api/v1/transcriptions endpoint, where insufficient validation of the file.content_type and user-controlled filenames allows for path traversal. An attacker, after authenticating to the system, can craft a malicious file upload request. This request, if successful, overwrites files within the OpenWebUI Docker container. Given that OpenWebUI often runs with root privileges within the container, this overwrite can lead to arbitrary code execution as the root user. The blast radius extends to the entire containerized environment, potentially compromising the host system if container isolation is not properly configured. This vulnerability shares similarities with other file upload vulnerabilities where improper validation leads to path traversal and subsequent code execution.

Organizations deploying OpenWebUI within Docker containers, particularly those using it for sensitive audio processing tasks, are at significant risk. Shared hosting environments where OpenWebUI is installed could also be vulnerable if multiple users share the same container.

• linux / server: Monitor Docker container logs for unusual file creation or modification activity, particularly within the OpenWebUI application directory. Use journalctl -u openwebui to check for suspicious API calls.

journalctl -u openwebui | grep '/audio/api/v1/transcriptions'

• generic web: Monitor web server access logs for requests to /audio/api/v1/transcriptions with unusual or unexpected Content-Type headers.

grep '/audio/api/v1/transcriptions' /var/log/apache2/access.log

• python: If you have access to the OpenWebUI source code, review the /audio/api/v1/transcriptions endpoint for inadequate file validation logic.

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-08-21
2. Veröffentlicht2025-03-20
3. Geändert2025-10-15
4. EPSS aktualisiert2026-04-02

The primary mitigation is to upgrade OpenWebUI to version 0.5.17 or later, which contains the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Implement strict input validation on the file.content_type parameter within the /audio/api/v1/transcriptions endpoint. Restrict allowed file extensions to only those explicitly required for transcription processing. Employ a Web Application Firewall (WAF) to filter requests containing suspicious filenames or content types. Monitor container logs for unusual file creation or modification events, particularly within the OpenWebUI container's root directory. After upgrading, confirm the fix by attempting a file upload with a deliberately malicious filename and verifying that the upload is rejected.