Path Traversal Vulnerability in Open WebUI's Terminal-Server Reverse Proxy

CVE-2026-54017

What is CVE-2026-54017?

The Open WebUI platform is vulnerable to a path traversal issue due to insufficient input validation in the terminal-server reverse proxy. This vulnerability allows an authenticated user to manipulate the path parameter, potentially leading to unauthorized access to sensitive files and endpoints on the terminal-server host. Attackers can exploit this issue by crafting specific path values that include encoded traversal sequences, enabling them to bypass security measures and access internal services. The introduction of double-encoded dots further complicates mitigation efforts. The vulnerability is addressed in version 0.9.6.

References