f5dcad4 fix(images): add null-check in upload_image to prevent crash on SSRF block
📊 Changes
1 file changed (+10 additions, -0 deletions)
View changed files
📝backend/open_webui/routers/images.py (+10 -0)
📄 Description
Pull Request Checklist
Before submitting, make sure you've checked the following:
Linked Issue/Discussion: This PR references an existing Issue — Closes #24565.
Target branch: Verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request down below.
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
Git Hygiene: Keep PRs atomic (one logical change). Clean up commits and rebase on dev to ensure no unrelated commits.
Changelog Entry
Fixed
Add null-check in upload_image to prevent crash when get_image_data returns (None, None) due to SSRF block (e.g., ComfyUI on private IP)
Description
When get_image_data returns (None, None) due to an SSRF block (e.g., ComfyUI on private IP like 192.168.x.x), upload_image crashed with 'NoneType' object has no attribute 'lower' in mimetypes.guess_extension
This is a regression from PR #24518 which added validate_url() to prevent SSRF attacks
Add a null-check at the start of upload_image that raises a descriptive HTTPException pointing users to the ENABLE_RAG_LOCAL_WEB_FETCH workaround
By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/24674
**Author:** [@mturac](https://github.com/mturac)
**Created:** 5/13/2026
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `fix/comfyui-clean`
---
### 📝 Commits (1)
- [`f5dcad4`](https://github.com/open-webui/open-webui/commit/f5dcad4208b4beb4451efb076c21ad6c4c798402) fix(images): add null-check in upload_image to prevent crash on SSRF block
### 📊 Changes
**1 file changed** (+10 additions, -0 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/routers/images.py` (+10 -0)
</details>
### 📄 Description
# Pull Request Checklist
**Before submitting, make sure you've checked the following:**
- [x] **Linked Issue/Discussion:** This PR references an existing [Issue](https://github.com/open-webui/open-webui/issues) — `Closes #24565`.
- [x] **Target branch:** Verify that the pull request targets the `dev` branch.
- [x] **Description:** Provide a concise description of the changes made in this pull request down below.
- [x] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
- [x] **Git Hygiene:** Keep PRs atomic (one logical change). Clean up commits and rebase on `dev` to ensure no unrelated commits.
# Changelog Entry
### Fixed
- Add null-check in `upload_image` to prevent crash when `get_image_data` returns `(None, None)` due to SSRF block (e.g., ComfyUI on private IP)
### Description
- When `get_image_data` returns `(None, None)` due to an SSRF block (e.g., ComfyUI on private IP like `192.168.x.x`), `upload_image` crashed with `'NoneType' object has no attribute 'lower'` in `mimetypes.guess_extension`
- This is a regression from PR #24518 which added `validate_url()` to prevent SSRF attacks
- Add a null-check at the start of `upload_image` that raises a descriptive `HTTPException` pointing users to the `ENABLE_RAG_LOCAL_WEB_FETCH` workaround
### Related
- Regression from #24518
- Workaround: Set `ENABLE_RAG_LOCAL_WEB_FETCH=true`
---
### Additional Information
- Fixes #24565
### Contributor License Agreement
- [x] By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/24674
Author: @mturac
Created: 5/13/2026
Status: ❌ Closed
Base:
dev← Head:fix/comfyui-clean📝 Commits (1)
f5dcad4fix(images): add null-check in upload_image to prevent crash on SSRF block📊 Changes
1 file changed (+10 additions, -0 deletions)
View changed files
📝
backend/open_webui/routers/images.py(+10 -0)📄 Description
Pull Request Checklist
Before submitting, make sure you've checked the following:
Closes #24565.devbranch.devto ensure no unrelated commits.Changelog Entry
Fixed
upload_imageto prevent crash whenget_image_datareturns(None, None)due to SSRF block (e.g., ComfyUI on private IP)Description
get_image_datareturns(None, None)due to an SSRF block (e.g., ComfyUI on private IP like192.168.x.x),upload_imagecrashed with'NoneType' object has no attribute 'lower'inmimetypes.guess_extensionvalidate_url()to prevent SSRF attacksupload_imagethat raises a descriptiveHTTPExceptionpointing users to theENABLE_RAG_LOCAL_WEB_FETCHworkaroundRelated
ENABLE_RAG_LOCAL_WEB_FETCH=trueAdditional Information
Contributor License Agreement
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.