Path Traversal Vulnerability in Open WebUI's Terminal-Server Reverse Proxy
CVE-2026-54017

7.7HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
18 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-54017?

The Open WebUI platform is vulnerable to a path traversal issue due to insufficient input validation in the terminal-server reverse proxy. This vulnerability allows an authenticated user to manipulate the path parameter, potentially leading to unauthorized access to sensitive files and endpoints on the terminal-server host. Attackers can exploit this issue by crafting specific path values that include encoded traversal sequences, enabling them to bypass security measures and access internal services. The introduction of double-encoded dots further complicates mitigation efforts. The vulnerability is addressed in version 0.9.6.

Affected Version(s)

open-webui < 0.9.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cortex9-open-webui-proxy-multidecode-traversal-model
Created by federiconbaez

References

https://github.com/open-webui/open-webui/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.