CVE-2026-54017: Open WebUI Terminal Proxy Path Traversal (v0.9.6 Fix)

Technical summary

The vulnerability exists in `backend/open_webui/routers/terminals.py`, where user-supplied `path` parameters are forwarded to an admin-configured terminal server without proper confinement. The original path traversal vector uses single-encoded sequences; however, a subsequent mitigation attempt using `_sanitize_proxy_path` can be bypassed with double-encoded dots (`%252e%252e`). This creates two distinct exploitation pathways within the same code flow. Where the terminal server proxies requests to backend services, authenticated attackers gain SSRF-like access to those internal endpoints. This differs from CVE-2024-56765 (GHSA-c6xv-rcvw-v685), which targets `/api/v1/retrieval/process/web` through a separate input vector.

Business impact

An authenticated attacker can read sensitive files from the terminal server host, access configuration files, retrieve credentials or API keys, and pivot to internal services that the terminal server connects to. In environments where Open WebUI is used for development or administrative automation, this could expose source code, deployment secrets, or access to connected AI models and databases. The impact is contained to users with existing terminal access, but the scope is changed—an attacker can reach systems beyond the intended terminal boundary.

Affected systems

Open WebUI versions prior to 0.9.6 are affected. The vulnerability requires a deployed terminal server integrated with Open WebUI and an authenticated user account with terminal access permissions. Self-hosted instances running vulnerable versions and exposing terminal functionality face the highest risk.

Exploitability

Exploitation requires valid authentication and terminal-server access (a feature that must be explicitly enabled and configured). No user interaction is needed once authenticated. The attack is straightforward—path parameters can be manipulated via HTTP request, and no special client capabilities are required. However, the CVSS score (7.7 HIGH) reflects that exploitation is practical for any user with terminal permissions; it is not widespread yet (KEV status: not listed) and depends on environmental configuration.

Remediation

Upgrade Open WebUI to version 0.9.6 or later. This version implements robust path normalization that prevents both single and double-encoded traversal sequences. For organizations unable to patch immediately, restrict terminal-server access to trusted administrators only and audit current user permissions.

Patch guidance

Update to Open WebUI 0.9.6 or any subsequent release. Verify the patch is applied by checking the running version in your Open WebUI instance settings or deployment manifest. If using container deployments, rebuild with the latest image tag. Test the update in a non-production environment first to ensure compatibility with your terminal-server configuration.

Detection guidance

Monitor terminal server access logs for requests containing encoded path traversal patterns: `../`, `..%2f`, `%2e%2e`, and `%252e%252e` sequences in the `path` parameter. Search application logs for HTTP 400 or 403 responses to unusual path requests from authenticated users. Network-based detection should flag outbound connections from the terminal-server host to unexpected internal services initiated by authenticated users with terminal permissions. Correlate authentication logs with file-access or service-enumeration activity on the terminal server.

Why prioritize this

Although currently not listed on CISA's KEV catalog, this is a HIGH-severity vulnerability affecting a self-hosted AI platform that may operate in sensitive environments. The dual vectors (original traversal and mitigation bypass) indicate that patching attempts have been necessary, which increases urgency. The attack surface is limited by authentication and feature configuration, but for organizations that do expose terminal functionality, the ease of exploitation and severity of information disclosure warrant rapid patching. Prioritize if your deployment uses Open WebUI with terminal-server integration.

Risk score, explained

CVSS 7.7 (HIGH) reflects a network-accessible service, low complexity, requirement for authentication (not admin), and high confidentiality impact with changed scope—the attacker can reach services beyond the intended terminal boundary. Integrity and availability are not impacted. The score appropriately captures the practical threat: authenticated users can systematically extract sensitive data without requiring additional privileges or user interaction.

Frequently asked questions