Open WebUI: open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Record
- CVE-2026-59221
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 9, 2026
- Source last modified
- July 24, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass normalization checks and be decoded by the upstream terminal server. This issue is fixed in version 0.10.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted chat interface that lets people in your organization talk to AI models through a web page. This flaw affects versions 0.9.6 up to, but not including, 0.10.0. It sits in the part of Open WebUI that passes requests through to a connected terminal server (a separate service for running commands). A safety check meant to keep requests out of places they should not go can be tricked by a specially disguised request. The terminal server then follows that request to locations outside the ones it is meant to reach. This flaw is rated High.
What to do
- If you or someone on your staff installed Open WebUI and runs it, that person should check which version is running.
- If the version is 0.9.6 or later but older than 0.10.0, update to version
0.10.0, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update to version 0.10.0 will be done.
- After updating, check that Open WebUI shows version 0.10.0 or later and still works as expected.
Analysis written from the source record as of July 24, 2026 and reviewed before publishing.