diff --git a/backend/open_webui/routers/images.py b/backend/open_webui/routers/images.py index a851839919..8c6e772896 100644 --- a/backend/open_webui/routers/images.py +++ b/backend/open_webui/routers/images.py @@ -920,11 +920,8 @@ async def image_edits( if data.startswith('http://') or data.startswith('https://'): parsed = urlparse(data) - if ( - parsed.netloc == urlparse(str(request.base_url)).netloc - and parsed.path.startswith('/api/v1/files/') - and '/content' in parsed.path - ): + # Fetching /api/v1/files/{id}/content over the network would be unauthenticated. + if parsed.path.startswith('/api/v1/files/') and '/content' in parsed.path: return await load_url_image(parsed.path) # Validate URL to prevent SSRF attacks against local/private networks.