Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-54017
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 18, 2026
- Source last modified
- July 15, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in backend/open_webui/routers/terminals.py does not fully confine the user-controlled path segment before forwarding it to an admin-configured terminal server. An authenticated user who has been granted access to a terminal server can craft path values containing encoded ../ traversal sequences that escape the intended path (or policy) scope on that server, reaching unintended endpoints and files on the terminal-server host. Where the terminal server fans requests out to internal services, this also gives SSRF-style reach into those services. This is a separate code path from the /api/v1/retrieval/process/web SSRF (GHSA-c6xv-rcvw-v685), with its own input. Two distinct vectors are consolidated here: first, raw path forwarding / single-encoded traversal (original report); and second, a bypass of the subsequently-added _sanitize_proxy_path mitigation using double-encoded dots (%252e%252e). The attacker-controlled input is the request path, supplied by the non-admin user, not anything an administrator configures, so this is not an admin-trust / Rule-9 situation. Version 0.9.6 fixes the issue.
Description quoted from the NVD record.
Who is affected
This flaw affects Open WebUI, a chat interface for using AI language models that your organization runs on its own computers. It affects versions before 0.9.6. The problem is in the part of the product that passes users' requests on to terminal servers, which an administrator sets up for use with Open WebUI. A signed-in user who has been given access to a terminal server can trick Open WebUI into reaching files and services that should be off limits on the computer running that terminal server. Where the terminal server passes requests on to other internal services, the user can reach those too. This flaw is rated High.
What to do
- If you are not sure whether your organization uses Open WebUI, ask whoever looks after your computers to check.
- If your organization installed and runs Open WebUI itself, the person who looks after it should update it to version
0.9.6or later as soon as possible. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to version
0.9.6will be done. - After the update, have the person who made it check that Open WebUI now shows version
0.9.6or later.
Analysis written from the source record as of July 15, 2026 and reviewed before publishing.