CVE-2026-59221: 
Open WebUI vulnerability analysis and mitigation

CVE-2026-59221 is a path traversal vulnerability in Open WebUI's terminal proxy routing functionality, classified as High severity with a CVSS v3.1 base score of 7.7. The flaw exists in versions >= 0.9.6 and < 0.10.0 of the self-hosted AI platform. The _sanitize_proxy_path() function in backend/open_webui/routers/terminals.py decodes proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal sequence to bypass normalization checks and be decoded by the upstream terminal server into a valid traversal path. The vulnerability was published on July 9, 2026, and is fixed in version 0.10.0 (GitHub Advisory, v0.10.0 Release).

The root cause is classified as CWE-22 (Path Traversal) and CWE-918 (Server-Side Request Forgery). The vulnerable _sanitize_proxy_path() function iterates urllib.parse.unquote() a maximum of eight times and then applies posixpath.normpath() and a startswith('..') check — but if the input is encoded nine or more times, the dots and slashes remain percent-encoded (%2E%2E%2F) after the loop, causing the traversal check to pass since it looks for literal .. characters. The sanitized-but-still-encoded path is then forwarded via aiohttp.ClientSession.request() to the upstream terminal server, which decodes it once more and resolves the traversal (e.g., /base/../admin/system). This is a bypass of a prior fix for GHSA-r2wg-2mcr-66rv; the attacker only needs low-privilege access to an existing configured terminal connection — no admin interaction or malicious server is required. The 9x-encoded payload (%2E%2E%2F%61%64%6D%69%6E%2F%73%79%73%74%65%6D) is only 285 bytes, making it practical for real-world use (GitHub Advisory, Fix PR #26050).

A low-privileged authenticated user with access to a configured terminal connection can read arbitrary files accessible to the terminal server process, bypassing the intended directory boundary. For orchestrator-backed terminal connections, the bypass can also target sibling or parent routes after upstream decoding, since the sanitized path is placed under /p/{policy_id}/{safe_path}. The primary impact is high confidentiality loss (sensitive file disclosure), with no direct integrity or availability impact per the CVSS scoring (GitHub Advisory).

1. Authenticate: Obtain low-privilege credentials to an Open WebUI instance running version >= 0.9.6 and < 0.10.0 with at least one configured terminal connection.
2. Identify the terminal proxy endpoint: Locate the terminal proxy route (e.g., /api/v1/terminals/{terminal_id}/proxy/{path}) exposed by the Open WebUI backend.
3. Craft a 9x percent-encoded traversal payload: Encode the traversal string ../admin/system nine times using percent-encoding. The first pass produces %2E%2E%2F%61%64%6D%69%6E%2F%73%79%73%74%65%6D; subsequent passes encode the % characters as %25. Account for the ASGI server decoding the HTTP path once before it reaches _sanitize_proxy_path(), so the external request should use one additional encoding layer (10x total externally, resulting in 9x reaching the sanitizer).
4. Send the crafted request: Issue an authenticated HTTP GET request to the terminal proxy endpoint with the 9x-encoded traversal path as the {path} parameter.
5. Bypass sanitization: The _sanitize_proxy_path() function decodes the path only 8 times, leaving it still encoded after the loop. The posixpath.normpath() and startswith('..') checks pass because the dots are still %2E, not literal ...
6. Upstream decoding resolves traversal: The upstream terminal server receives the forwarded request, decodes the path once, and resolves it to /base/../admin/system, granting access to files outside the intended directory.
7. Exfiltrate data: Read sensitive files (e.g., configuration files, credentials, or system files) accessible to the terminal server process (GitHub Advisory).

• Network: HTTP requests to the terminal proxy endpoint containing heavily percent-encoded path segments (e.g., %252E%252E%252F or similar multi-encoded dot-slash sequences); outbound requests from the Open WebUI backend to the terminal server with decoded traversal paths such as /../ or /base/../.
• Logs: Open WebUI access logs showing requests to /api/v1/terminals/.*/proxy/ with path parameters containing %25 sequences (percent-encoded percent signs) or unusually long encoded path strings (~285+ bytes); terminal server logs showing requests to paths containing .. or resolving outside the expected base directory.
• File System: Unexpected access to sensitive files (e.g., /etc/passwd, configuration files, credential stores) by the terminal server process, observable via file access audit logs (e.g., auditd on Linux).
• Process: Anomalous file read activity by the terminal server process accessing directories outside its expected working directory (GitHub Advisory).

Upgrade Open WebUI to version 0.10.0 or later, which fixes the issue by adding a "fail closed" check: after the decode loop, if unquote(decoded) != decoded (i.e., the value is still encoded), the path is rejected rather than forwarded (Fix Commit, v0.10.0 Release). If immediate patching is not possible, restrict access to the terminal router endpoint to only trusted users and implement network-level controls (e.g., firewall rules, reverse proxy ACLs) to limit who can reach the terminal proxy component (GitHub Advisory).