CVE-2026-54017

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in "backend/openwebui/routers/terminals.py" does not fully confine the user-controlled "path" segment before forwarding it to an admin-configured...

CVE-2026-54017: Improper Limitation of a Pathname to a Restricted Directory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in backend/openwebui/routers/terminals.py does not fully confine the user-controlled path segment before forwarding it to an admin-configured termin...