CVE-2026-54014 Open WebUI Path Traversal – File Access Vulnerability

Technical summary

The vulnerability exists in the serve_cache_file() function within open_webui/main.py. The function validates requested file paths using file_path.startswith(os.path.abspath(CACHE_DIR)) without appending a trailing path separator (os.sep). This allows an attacker to craft requests that resolve to paths in sibling directories whose names begin with the cache directory string—for example, 'cache_sibling', 'cache_backup', or 'cached_models'—which would pass the incomplete startswith() check. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) classifies this flaw. Authentication is required, limiting exposure to users with valid credentials.

Business impact

Organizations deploying Open WebUI in offline environments face risk of sensitive data exposure through unauthorized file access. The vulnerability could allow insiders or compromised user accounts to exfiltrate configuration files, model data, or other non-cache assets stored on the same host. While the MEDIUM severity reflects the requirement for authentication, the potential scope of readable files depends on the deployment's data sensitivity and the breadth of sibling directories present. For production AI deployments, even authenticated access violations may trigger compliance concerns.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. The vulnerability affects both fresh installations and existing deployments that have not yet upgraded. Self-hosted instances running on any operating system (Linux, macOS, Windows) are in scope, provided they serve the cache endpoint to authenticated users. Fully air-gapped deployments and instances with strict network isolation may face reduced practical risk, though the flaw remains present.

Exploitability

Exploitation requires valid authentication credentials, which moderately limits the attack surface. An authenticated user can bypass the path containment check by requesting files from sibling directories through crafted API calls to the cache file serving endpoint. No user interaction or special conditions are needed once authenticated. The straightforward nature of the validation flaw (a missing path separator) makes it low complexity to exploit for an attacker with access. Public disclosure of the root cause will likely prompt rapid weaponization in threat actor playbooks targeting Open WebUI deployments.

Remediation

Upgrade to Open WebUI version 0.9.6 or later, which corrects the path validation logic to include the trailing path separator and prevent sibling directory bypass. Prior to upgrading, organizations should audit file access logs for suspicious cache endpoint requests from authenticated users and review what sensitive files exist in sibling directories. Consider restricting the cache endpoint to trusted network segments or limiting user account creation as interim controls.

Patch guidance

Apply the upgrade to 0.9.6 as soon as possible following your standard change management procedures. The patch modifies the validation check to properly isolate the cache directory, eliminating the sibling directory bypass. Verify the upgrade through your deployment method (container image, package manager, or source installation) and confirm version number after restart. No breaking changes or data migration are indicated; the fix is a validation tightening.

Detection guidance

Monitor access logs for the cache file serving endpoint (/cache or similar routes depending on configuration) for patterns indicating directory traversal attempts, such as requests containing path traversal sequences or references to parent/sibling directories. Alert on authenticated users accessing cache endpoints with unusual frequency or from unexpected source IPs. File integrity monitoring on sibling directories can detect unauthorized reads. Intrusion detection signatures should cover attempts to resolve paths outside CACHE_DIR.

Why prioritize this

While CVSS 4.3 reflects the authentication requirement and confidentiality-only impact, the flaw is straightforward to exploit and affects all instances below 0.9.6. Prioritization should account for: (1) whether Open WebUI stores sensitive model data or configuration in sibling directories, (2) the trust level of your user base, and (3) compliance or contractual data protection obligations. Organizations running Open WebUI in production should treat this as a near-term patch target; development or non-critical instances can follow standard patching cycles.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) reflects: Network vector (accessible remotely), Low attack complexity (straightforward path manipulation), but Login required (PR:L), resulting in reduced overall impact. Severity is constrained to Confidentiality (C:L) with no Integrity or Availability impact. The score appropriately captures that exploitation requires credentials; however, real-world risk depends on what files exist in sibling directories and how Open WebUI is deployed in your environment. Organizations storing high-sensitivity AI models or training data adjacent to the cache directory should weight the risk higher.

Frequently asked questions