CVE-2026-59221: Open WebUI encoded path traversal

Q: Is CVE-2026-59221 actively exploited?

No confirmed active exploitation of CVE-2026-59221 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59221?

Upgrade to Open WebUI 0.10.0 or later, which fixes _sanitize_proxy_path's decode-loop limitation. Until patched, disable or restrict the terminal feature to fully trusted administrators only, and ensure the underlying terminal server process runs with minimal filesystem permissions and is not co-located with secrets (env files, credential stores). Add detection for requests to terminal/proxy endpoints containing repeated or unusually long percent-encoding chains (e.g., patterns like %2525252e%2525252e%252f), and review access logs for terminal-endpoint activity from non-admin accounts around the disclosure window. Network-segment the terminal proxy path so even a successful traversal cannot reach sensitive host paths.

Q: What systems are affected by CVE-2026-59221?

This vulnerability affects the following AI/ML architecture patterns: model serving, self-hosted LLM UI deployments, internal admin/developer tooling.

Q: What is the CVSS score for CVE-2026-59221?

CVE-2026-59221 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.48%.

CISO Take

Open WebUI's terminal feature normalizes proxy paths by decoding percent-encoding eight times before checking for directory traversal, but an attacker who percent-encodes a "../" sequence nine times slips past that check and gets fully decoded by the upstream terminal server, landing outside the intended directory. This requires only a low-privileged, authenticated account (PR:L) and no user interaction, and the CVSS 7.7 score reflects a full confidentiality breach with no integrity or availability loss — meaning file read, not file write or crash. There is no evidence of active exploitation: it isn't in CISA KEV, EPSS data is unavailable, and no public exploit or Nuclei template exists yet, so this is a patch-now-not-panic-now situation rather than a breaking alert. The fix ships in Open WebUI 0.10.0, and any self-hosted instance exposing the terminal feature to non-admin users should upgrade immediately or disable that feature until patched, since it is the direct entry point into the host filesystem behind the AI platform's UI layer.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Network-reachable, low complexity, and requiring only a low-privileged account with no user interaction makes this easy to trigger once an attacker has any foothold in the platform (e.g., a compromised or malicious end-user account). Impact is confined to confidentiality (arbitrary file disclosure via the terminal proxy) with no integrity or availability effect per the CVSS vector, but the changed scope (S:C) means the disclosure can reach beyond the terminal component itself into whatever the upstream terminal server can access. With no KEV listing, no EPSS score, and no public PoC/scanner template, real-world exploitation likelihood today is low, but the bug is trivial to weaponize once understood (a scripted N-times percent-encoding wrapper), so risk will rise quickly if a PoC is published.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds a low-privileged Open WebUI account with access to the terminal feature.

Craft Encoded Payload

Attacker percent-encodes a "../" traversal sequence nine times so it survives the terminal proxy's eight-pass decode-and-check routine.

Proxy Exploitation

The malformed path is forwarded to the upstream terminal server, which fully decodes it and traverses outside the sandboxed working directory.

AML.T0049

Data Exposure

Attacker reads arbitrary files reachable by the terminal server process, potentially exposing credentials or configuration tied to the AI stack.

AML.T0037

Authenticated Access

Attacker obtains or already holds a low-privileged Open WebUI account with access to the terminal feature.

Craft Encoded Payload

Attacker percent-encodes a "../" traversal sequence nine times so it survives the terminal proxy's eight-pass decode-and-check routine.

Proxy Exploitation

The malformed path is forwarded to the upstream terminal server, which fully decodes it and traverses outside the sandboxed working directory.

AML.T0049

Data Exposure

Attacker reads arbitrary files reachable by the terminal server process, potentially exposing credentials or configuration tied to the AI stack.

AML.T0037

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	>= 0.9.6, < 0.10.0	`0.10.0`
149.6K 4 dependents Pushed 3d ago 81% patched ~6d to patch Full package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I None

A None

What should I do?

1 step

Upgrade to Open WebUI 0.10.0 or later, which fixes _sanitize_proxy_path's decode-loop limitation. Until patched, disable or restrict the terminal feature to fully trusted administrators only, and ensure the underlying terminal server process runs with minimal filesystem permissions and is not co-located with secrets (env files, credential stores). Add detection for requests to terminal/proxy endpoints containing repeated or unusually long percent-encoding chains (e.g., patterns like %2525252e%2525252e%252f), and review access logs for terminal-endpoint activity from non-admin accounts around the disclosure window. Network-segment the terminal proxy path so even a successful traversal cannot reach sensitive host paths.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Framework Plugin AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - Security of the AI system

NIST AI RMF

MANAGE 4.1 - Post-deployment monitoring and risk response

Frequently Asked Questions

What is CVE-2026-59221?

Open WebUI's terminal feature normalizes proxy paths by decoding percent-encoding eight times before checking for directory traversal, but an attacker who percent-encodes a "../" sequence nine times slips past that check and gets fully decoded by the upstream terminal server, landing outside the intended directory. This requires only a low-privileged, authenticated account (PR:L) and no user interaction, and the CVSS 7.7 score reflects a full confidentiality breach with no integrity or availability loss — meaning file read, not file write or crash. There is no evidence of active exploitation: it isn't in CISA KEV, EPSS data is unavailable, and no public exploit or Nuclei template exists yet, so this is a patch-now-not-panic-now situation rather than a breaking alert. The fix ships in Open WebUI 0.10.0, and any self-hosted instance exposing the terminal feature to non-admin users should upgrade immediately or disable that feature until patched, since it is the direct entry point into the host filesystem behind the AI platform's UI layer.

Is CVE-2026-59221 actively exploited?

No confirmed active exploitation of CVE-2026-59221 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59221?

Upgrade to Open WebUI 0.10.0 or later, which fixes _sanitize_proxy_path's decode-loop limitation. Until patched, disable or restrict the terminal feature to fully trusted administrators only, and ensure the underlying terminal server process runs with minimal filesystem permissions and is not co-located with secrets (env files, credential stores). Add detection for requests to terminal/proxy endpoints containing repeated or unusually long percent-encoding chains (e.g., patterns like %2525252e%2525252e%252f), and review access logs for terminal-endpoint activity from non-admin accounts around the disclosure window. Network-segment the terminal proxy path so even a successful traversal cannot reach sensitive host paths.

What systems are affected by CVE-2026-59221?

This vulnerability affects the following AI/ML architecture patterns: model serving, self-hosted LLM UI deployments, internal admin/developer tooling.

What is the CVSS score for CVE-2026-59221?

CVE-2026-59221 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

model servingself-hosted LLM UI deploymentsinternal admin/developer tooling

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass normalization checks and be decoded by the upstream terminal server. This issue is fixed in version 0.10.0.

Exploitation Scenario

An attacker who has obtained or been granted a low-privileged Open WebUI account with terminal access crafts a proxy request path where a "../" sequence is percent-encoded nine times. Open WebUI's _sanitize_proxy_path decodes the path eight times and, seeing no raw traversal sequence, lets it through as normalized. The request is then forwarded to the upstream terminal server, which performs its own decoding pass, fully resolving the remaining encoding layer into an actual "../" traversal and walking outside the intended working directory. The attacker repeats the request against known sensitive paths (e.g., .env, SSH keys, application config) to exfiltrate file contents returned through the terminal proxy response, potentially harvesting credentials for the model backends or databases Open WebUI is connected to.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-918 Server-Side Request Forgery (SSRF)

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.