Executive brief
Open WebUI, a user interface for managing AI models, contains a security flaw in its terminal proxy component. An attacker with standard user access can bypass security filters to access internal system paths or administrative interfaces on the terminal server. This could lead to the exposure of sensitive configuration data or unauthorized access to internal services.
Technical details
A path traversal vulnerability exists in the `_sanitize_proxy_path` function within `backend/open_webui/routers/terminals.py`. The sanitizer attempts to prevent traversal by recursively decoding the path up to 8 times using `unquote()`; however, an attacker can use 9 layers of percent-encoding to bypass this limit. Because the 9th layer remains encoded during the security check, `posixpath.normpath()` fails to identify the traversal sequences (e.g., `../`). When the request is subsequently forwarded to the upstream terminal server, the server decodes the remaining layer, allowing the attacker to reach unauthorized paths. This vulnerability is a bypass of the fix previously implemented for GHSA-r2wg-2mcr-66rv.
Affected products
- open-webui open-webui >= 0.9.6, < 0.10.0
Timeline
- 2026-07-02: disclosed
- 2026-07-09: advisory: NVD publication
- 2026-07-24: patched: Version 0.10.0 released