A file upload endpoint in Open WebUI prior to version 0.10.0 accepts a metadata.knowledge_id field and automatically links uploaded files to a specified knowledge base without enforcing the usual write‑access check used by the /api/v1/knowledge//file/add API. Consequently, users with only read‑only privileges can upload arbitrary files that become part of the knowledge base. The vulnerability does not provide code execution; however, it compromises the integrity of the knowledge base by allowing an attacker to inject content that may be used in AI processing or data analytics, effectively escalating their privileges on that resource.

Open WebUI (open‑webui:open‑webui) releases before 0.10.0 are vulnerable. The issue is fixed in release 0.10.0; any deployment running an earlier version should upgrade to remediate.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog. An attacker requires an authenticated session with read‑only permissions on the knowledge base and must send a file upload request that includes the metadata.knowledge_id field. The exposure of the upload endpoint and the number of read‑only users influence the exploit likelihood, but the flaw represents a moderate risk that warrants timely remediation.