{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/open-webui--0.9.6--0.10.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openwebui:open_webui:0.9.6:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-59221"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Open WebUI (\u003e= 0.9.6, \u003c 0.10.0)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","web-application","vulnerability","open-webui","defense-evasion"],"_cs_type":"advisory","_cs_vendors":["Open WebUI"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-59221, has been identified in Open WebUI versions equal to or greater than 0.9.6 but less than 0.10.0. This flaw is a bypass of a previous security fix (GHSA-r2wg-2mcr-66rv) in the \u003ccode\u003e_sanitize_proxy_path()\u003c/code\u003e function within \u003ccode\u003ebackend/open_webui/routers/terminals.py\u003c/code\u003e. The sanitizer is intended to decode URL paths until stable to prevent directory traversal but fails when confronted with a 9x percent-encoded path traversal payload, such as \u003ccode\u003e../admin/system\u003c/code\u003e. This allows authenticated users with access to an admin-configured terminal connection to bypass the path traversal guard. Attackers can leverage this to send requests with the configured terminal credentials and \u003ccode\u003eX-User-Id\u003c/code\u003e header to arbitrary paths outside the intended proxy destination, potentially leading to unauthorized access or actions on the upstream terminal server. This issue does not require a malicious terminal server or social engineering to modify settings; it only requires normal access to an existing configured terminal connection.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker gains access to an existing configured terminal connection within the Open WebUI application.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a path traversal payload, such as \u003ccode\u003e../admin/system\u003c/code\u003e, and encodes it nine times (e.g., \u003ccode\u003e%2525...%252Fadmin%252Fsystem\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker sends an HTTP request containing this highly encoded payload as part of the URI path or query parameter to an Open WebUI terminal proxy endpoint.\u003c/li\u003e\n\u003cli\u003eThe ASGI server hosting Open WebUI performs an initial decoding pass on the HTTP path before passing it to the application's \u003ccode\u003e_sanitize_proxy_path()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_sanitize_proxy_path()\u003c/code\u003e function attempts to decode the path eight times, but the 9x encoded payload remains once-encoded after these passes.\u003c/li\u003e\n\u003cli\u003eThe subsequent security checks, including \u003ccode\u003eposixpath.normpath()\u003c/code\u003e and \u003ccode\u003ecleaned.startswith('..')\u003c/code\u003e, are bypassed because the path still contains percent-encoded characters, which are treated as ordinary strings.\u003c/li\u003e\n\u003cli\u003eOpen WebUI constructs a \u003ccode\u003etarget_url\u003c/code\u003e using the inadequately sanitized path and forwards the request to the configured upstream terminal server, including sensitive \u003ccode\u003eX-User-Id\u003c/code\u003e headers and terminal credentials.\u003c/li\u003e\n\u003cli\u003eThe upstream terminal server receives the request, fully decodes the path (e.g., \u003ccode\u003e/base/../admin/system\u003c/code\u003e), and processes it, allowing the attacker to access paths outside the intended \u003ccode\u003e/base/\u003c/code\u003e directory and potentially execute unauthorized commands or access sensitive data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-59221 enables authenticated users to bypass Open WebUI's terminal proxy path traversal guard. This allows attackers to redirect requests, including configured terminal credentials and the \u003ccode\u003eX-User-Id\u003c/code\u003e header, to arbitrary paths on the upstream terminal server that are outside the intended proxy scope. For orchestrator-backed connections, this bypass can also target sibling or parent routes after upstream decoding. This could lead to unauthorized access to system resources, execution of unauthorized commands, or manipulation of data on the terminal server. The vulnerability can be exploited by any user with normal access to a configured terminal connection, increasing the risk of insider threat or account compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-59221\u003c/strong\u003e: Upgrade Open WebUI to version 0.10.0 or later as soon as it is available to address the incomplete sanitization logic.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement URI Path Sanitization Rule\u003c/strong\u003e: Deploy the provided Sigma rule to detect highly encoded path traversals in webserver logs targeting terminal proxy endpoints.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor Webserver Logs\u003c/strong\u003e: Ensure comprehensive logging for web server access, specifically for \u003ccode\u003ecs-uri-stem\u003c/code\u003e and \u003ccode\u003ecs-uri-query\u003c/code\u003e fields, to identify unusual patterns of multi-percent-encoded characters.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Terminal Server Access\u003c/strong\u003e: Regularly audit access logs on configured terminal servers for requests originating from Open WebUI that target unusual or sensitive paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:07:22Z","date_published":"2026-07-24T21:07:22Z","id":"https://feed.craftedsignal.io/briefs/2026-07-open-webui-path-traversal-bypass/","summary":"An incomplete fix for a path traversal vulnerability in Open WebUI's terminal proxy allows authenticated attackers to bypass security checks by sending a 9x percent-encoded path, leading to requests being forwarded with terminal credentials and user identification headers to unintended arbitrary paths outside the intended proxy scope.","title":"Open WebUI Terminal Proxy Path Traversal Bypass via 9x Encoding (CVE-2026-59221)","url":"https://feed.craftedsignal.io/briefs/2026-07-open-webui-path-traversal-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Open WebUI (\u003e= 0.9.6, \u003c 0.10.0)","version":"https://jsonfeed.org/version/1.1"}