CVE-2026-54009: Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

POST /api/chat/completions accepts an image_url.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set image_url.url to another user’s file id, the server reads that file from disk, base64-encodes it, and injects the data URI into the LLM request. The user then prompts the LLM to describe / OCR the file and reads the content back.

Same class as CVE-2026-44560 (RAG cross-user access) and the multiple has_access_to_file checks added in routers/files.py – the auth boundary was tightened on the file router but not on this conversion path.