Skip to content
Threat Feed
Subscribe

Tag

Cve-2026-28788

1 brief RSS
high advisory

Open WebUI Authenticated File Overwrite Vulnerability (CVE-2026-28788)

Open WebUI before version 0.8.6 allows any authenticated user to overwrite arbitrary file content via the `POST /api/v1/retrieval/process/files/batch` endpoint, leading to privilege escalation and potential manipulation of LLM responses.

Open WebUI cve-2026-28788 open-webui file-overwrite privilege-escalation
2r 1t