What is the CVSS score of CVE-2026-59221?

CVE-2026-59221 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Open WebUI are affected by CVE-2026-59221?

Open WebUI versions 0.9.6 through 0.9.x contain a path traversal vulnerability in the terminal proxy component that allows authenticated users to bypass file access controls and retrieve sensitive…. A patch is available.

How to fix or mitigate CVE-2026-59221?

24 hours: Identify all systems running Open WebUI 0.9.6-0.9.x and restrict non-essential user access to terminal proxy features. 7 days: Upgrade all instances to Open WebUI 0.10.0 or later. 30 days: Review terminal proxy access logs for unauthorized file access attempts and audit user permissions on the terminal proxy component.

Open WebUI CVE-2026-59221

EUVD-2026-42650 HIGH

Path Traversal (CWE-22)

2026-07-09 security-advisories@github.com

GHSA-frvj-c5qp-xj4w

Path Traversal Open Webui Openwebui

7.7

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable proxy needs a valid account (PR:L) and no interaction; the encoding bypass is low-complexity (AC:L); traversal crosses into the upstream terminal server (S:C), disclosing files (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 19:01 EUVD

Analysis Generated

Jul 09, 2026 - 18:34 vuln.today

DescriptionCVE.org

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass normalization checks and be decoded by the upstream terminal server. This issue is fixed in version 0.10.0.

AnalysisAI

Path traversal in Open WebUI's terminal proxy (versions 0.9.6 through 0.9.x, fixed in 0.10.0) lets an authenticated attacker reach files and resources outside the intended proxy scope. The _sanitize_proxy_path routine in backend/open_webui/routers/terminals.py decoded incoming proxy paths exactly eight times, so a nine-times percent-encoded ../ sequence survived normalization and was decoded a final time by the upstream terminal server, defeating the traversal check. No public exploit or CISA KEV listing exists at time of analysis, but the scope-changing CVSS 3.1 score of 7.7 (S:C/C:H) signals meaningful confidentiality impact on the backend terminal component.

Technical ContextAI

Open WebUI is a self-hosted, extensible web front-end for interacting with local and remote large language models. The affected code path is backend/open_webui/routers/terminals.py, which proxies requests to an upstream terminal server; _sanitize_proxy_path is meant to canonicalize and reject directory-traversal input before forwarding. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the sanitizer performs a fixed, finite number of percent-decode passes (eight), while an attacker can layer encoding deeper (nine or more). Because the upstream terminal server performs its own additional decode, a ../ payload encoded nine times passes Open WebUI's checks in still-encoded form and is only fully resolved downstream, escaping the intended directory boundary. The correct fix is to decode fully to a fixed point (or reject any remaining encoded sequences) before validation, which v0.10.0 implements.

RemediationAI

Vendor-released patch: 0.10.0 - upgrade Open WebUI to v0.10.0 or later, which replaces the flawed eight-pass decode with correct normalization (fix commit https://github.com/open-webui/open-webui/commit/05098d25a58d03738e01c4e85e8852c3b4ad849c, PR https://github.com/open-webui/open-webui/pull/26050, advisory https://github.com/open-webui/open-webui/security/advisories/GHSA-frvj-c5qp-xj4w). If immediate upgrade is not possible, reduce exposure by disabling or not exposing the terminal proxy feature so the vulnerable /terminals route cannot be reached, and restrict network access to both the terminal server and the Open WebUI backend to trusted hosts only; the trade-off is that disabling the terminal feature removes in-app terminal functionality for users. Additionally, tighten account provisioning and remove untrusted accounts, since exploitation requires an authenticated session (PR:L).