CVE-2026-59221: Open WebUI Path Traversal (v0.9.6-0.9.x)

Technical summary

The vulnerability exists in the _sanitize_proxy_path function within backend/open_webui/routers/terminals.py. This function is responsible for normalizing and validating proxy paths before passing them to an upstream terminal server. The function decodes percent-encoded characters iteratively, but only performs eight iterations. An attacker with valid authentication credentials can bypass the normalization check by submitting a path encoded nine times (e.g., %252e%252e%252f repeated), which allows one additional level of decoding to occur in the upstream server, resulting in a valid ../ traversal sequence. This enables directory traversal attacks to read arbitrary files on the host system.

Business impact

An authenticated user can leverage this vulnerability to read sensitive configuration files, credentials, private keys, or other data stored on the Open WebUI server. For organizations using Open WebUI to expose AI capabilities, this could lead to exposure of system secrets, API keys, or user data stored in accessible directories. The impact is scoped to confidentiality; the vulnerability does not enable modification or deletion of data, but the reconnaissance capability is significant.

Affected systems

Open WebUI versions 0.9.6 through 0.9.x are vulnerable. Version 0.10.0 and later contain the fix. Any deployment of Open WebUI in the affected version range with network exposure and user authentication enabled is at risk.

Exploitability

Exploitation requires valid authentication credentials to access the platform, which raises the bar slightly compared to unauthenticated attacks. However, once authenticated, the attack is trivial to execute—it simply requires crafting a properly encoded URL with nine percent-encoding layers. No special tools, exploits, or user interaction are required beyond sending a malicious HTTP request. The attack surface is any authenticated user, including low-privilege accounts.

Remediation

Upgrade Open WebUI to version 0.10.0 or later immediately. The fix corrects the _sanitize_proxy_path function to properly validate and decode paths regardless of encoding depth, preventing traversal attacks. Organizations unable to upgrade immediately should restrict network access to the Open WebUI platform, limit authentication to trusted users, and monitor terminal access logs for suspicious path traversal patterns.

Patch guidance

Verify your current Open WebUI version and upgrade to 0.10.0 or later. Consult the official Open WebUI release notes and repository for installation instructions. For containerized deployments, update the image tag or digest. For source-based installations, pull the latest code from the official repository and restart the service. Verify the fix by reviewing the updated _sanitize_proxy_path function in the patched release.

Detection guidance

Monitor HTTP request logs for terminal routing endpoints with suspicious percent-encoded patterns, particularly sequences containing %2e%2e%2f (encoded ../) or repeated percent-encoding (e.g., %25 appearing multiple times). Review terminal access logs for attempts to traverse to unexpected directories or system paths. Log authentication events and correlate them with unusual API activity. Implement WAF rules to block requests with excessive percent-encoding layers in the path parameter.

Why prioritize this

This vulnerability merits urgent attention due to its HIGH CVSS score (7.7), cross-system scope impact, and requirement for only low-privileged authentication. While it does not enable code execution or service disruption, the ability to read arbitrary files via authenticated path traversal poses a significant confidentiality risk. Organizations with Open WebUI deployments exposed to untrusted networks or with multiple user accounts should treat this as a near-critical patch.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects a network-accessible vulnerability (AV:N) with low complexity (AC:L) that requires only low-privileged authentication (PR:L). The impact is high confidentiality loss (C:H) with no integrity or availability impact (I:N/A:N). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component, accounting for multi-tenant deployments and shared infrastructure. The score appropriately reflects a serious but not critical issue.

Frequently asked questions