Executive brief
Open WebUI, a self-hosted AI platform, contains a security flaw in its terminal server proxy. An authenticated user with access to a terminal can bypass security restrictions to access unauthorized files or internal services on the host server. This could lead to the exposure of sensitive configuration files, internal data, or unauthorized access to other private systems connected to the terminal server.
Technical details
A path traversal vulnerability exists in `backend/open_webui/routers/terminals.py` within Open WebUI. The terminal-server reverse proxy fails to properly sanitize the `path` segment, allowing authenticated users to use single or double-encoded traversal sequences (e.g., `%252e%252e`) to escape the intended directory or policy scope. This occurs because the `_sanitize_proxy_path` function only performed a single URL-decoding pass, allowing double-encoded dots to bypass the `startswith('..')` check. An attacker can leverage this to reach unintended endpoints on the terminal-server host or perform SSRF against internal services. The issue is fixed in version 0.9.6 by implementing recursive URL decoding before normalization.
Affected products
- open-webui Open WebUI < 0.9.6
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-18: disclosed: CVE published to NVD
- 2026-06-18: patched: Version 0.9.6 released to address the vulnerability