From 8dd015368cd8777f1c364442c102f1c90e68870b Mon Sep 17 00:00:00 2001
From: DrMelone <27028174+Classic298@users.noreply.github.com>
Date: Fri, 3 Apr 2026 22:40:20 +0200
Subject: [PATCH] fix: constrain relative paths to known-safe prefixes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Accepting any relative path starting with / allowed a user to set
their profile_image_url to an arbitrary internal GET endpoint. When
another user (e.g. an admin) views that profile, the browser fires
the GET with the viewer's session cookies — an authenticated GET
trigger surface.

Constrain to known-safe prefixes (/api/v1/users/, /static/) and
exact matches (/user.png, /favicon.png) which are the only relative
paths OWUI itself generates.
---
 backend/open_webui/utils/validate.py | 34 +++++++++++++++++++++-------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/backend/open_webui/utils/validate.py b/backend/open_webui/utils/validate.py
index 98e03d9166..1482eeb4b2 100644
--- a/backend/open_webui/utils/validate.py
+++ b/backend/open_webui/utils/validate.py
@@ -10,6 +10,21 @@ _SAFE_DATA_URI_RE = re.compile(
     r'^data:image/(png|jpeg|gif|webp);base64,', re.IGNORECASE
 )
 
+# Relative path prefixes that are safe to accept as profile image URLs.
+# These are the only patterns OWUI itself generates; arbitrary relative
+# paths are rejected to prevent authenticated GET triggers against
+# internal endpoints when other users view a profile.
+_SAFE_RELATIVE_PATH_PREFIXES = (
+    '/api/v1/users/',  # OWUI-generated profile image routes
+    '/static/',        # Static assets served by the frontend
+)
+
+# Exact relative paths accepted (default avatars).
+_SAFE_RELATIVE_PATHS = frozenset({
+    '/user.png',
+    '/favicon.png',
+})
+
 
 def validate_profile_image_url(url: str) -> str:
     """
@@ -17,21 +32,23 @@ def validate_profile_image_url(url: str) -> str:
 
     Allowed formats:
     - Empty string (falls back to default avatar)
-    - Relative paths starting with ``/`` (internal assets and API routes)
+    - Known-safe relative paths (default avatars, static assets,
+      and OWUI profile image API routes)
     - ``http://`` and ``https://`` URLs with a valid host
     - ``data:image/{png,jpeg,gif,webp};base64,...`` URIs
 
     All other schemes (javascript:, file:, ftp:, etc.) are rejected.
     SVG data URIs are rejected because SVG can contain embedded scripts.
+    Arbitrary relative paths are rejected to prevent authenticated GET
+    requests against internal endpoints.
     """
     if not url:
         return url
 
-    # Relative paths: covers /user.png, /static/favicon.png,
-    # /api/v1/users/{id}/profile/image, and any future internal routes.
-    # Exclude scheme-relative URLs (//host/path) which browsers resolve
-    # against the current protocol.
-    if url.startswith('/') and not url.startswith('//'):
+    # Known-safe relative paths generated by OWUI itself.
+    if url in _SAFE_RELATIVE_PATHS:
+        return url
+    if any(url.startswith(prefix) for prefix in _SAFE_RELATIVE_PATH_PREFIXES):
         return url
 
     # urlparse normalises the scheme to lowercase, giving us
@@ -55,7 +72,8 @@ def validate_profile_image_url(url: str) -> str:
         return url
 
     raise ValueError(
-        'Invalid profile image URL: must be a relative path, an HTTP(S) URL '
-        'with a host, or a data:image URI (png/jpeg/gif/webp).'
+        'Invalid profile image URL: must be a known internal path, '
+        'an HTTP(S) URL with a host, or a data:image URI (png/jpeg/gif/webp).'
     )
 
+