The flaw in Open WebUI's process_files_batch endpoint allows any authenticated user to overwrite files without verifying ownership. This permits an attacker to replace content in files that are later retrieved by the LLM for Retrieval-Augmented Generation, thereby controlling the information the model presents to other users. The vulnerability is a classic case of privilege escalation (CWE‑639) and, with a CVSS score of 7.1, represents a moderate to high severity risk.

The vulnerability affects installations of Open WebUI prior to version 0.8.6. Users running an earlier release are susceptible; the issue was fixed in 0.8.6 and later versions. Administrators should verify the exact deployment version and confirm that upgrades have been applied.

The attack requires authenticated access and the ability to read file UUIDs via the knowledge base API. An attacker with read rights can obtain a list of file identifiers, then use the vulnerable endpoint to replace content. The exploit is straightforward once the necessary permissions are present, but no elevated privileges are needed beyond an authenticated session. The CVSS score of 7.1 reflects the ability to tamper with data that feeds the LLM. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the potential for targeted attacks against internal deployments remains significant.