CVE-2026-54014: Open WebUI Path Traversal Vulnerability

CVE-2026-54014 Overview

CVE-2026-54014 is a path traversal vulnerability [CWE-22] in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw exists in the cache file serving endpoint and affects all versions prior to 0.9.6. An authenticated user can read files from sibling directories outside the intended cache directory by abusing an incomplete containment check. The vulnerability was fixed in version 0.9.6.

Critical Impact
Authenticated attackers can read arbitrary files from sibling directories whose names begin with cache, exposing model artifacts, backups, and other sensitive data adjacent to the cache directory.

Affected Products

Open WebUI versions prior to 0.9.6
Self-hosted Open WebUI deployments exposing the cache file serving endpoint
Multi-user Open WebUI instances where untrusted authenticated users have access

Discovery Timeline

2026-06-23 - CVE-2026-54014 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54014

Vulnerability Analysis

The vulnerability resides in the serve_cache_file() function within open_webui/main.py. The function validates the resolved file path using file_path.startswith(os.path.abspath(CACHE_DIR)) without appending os.sep to the comparison base. This produces an incomplete prefix match. Any path that resolves to a sibling directory whose name shares the cache prefix passes the check.

Examples of directories that bypass the validation include cache_sibling, cache_backup, and cached_models. The endpoint then serves files from those directories to any authenticated caller. The flaw allows read-only disclosure of files but does not directly enable modification or denial of service.

Root Cause

The root cause is an incorrect string-prefix containment check used as a directory boundary. The expression startswith(CACHE_DIR) treats CACHE_DIR as a prefix string rather than a directory path. Without a trailing path separator, the check fails to distinguish /var/lib/openwebui/cache from /var/lib/openwebui/cache_backup. This is a classic insecure path canonicalization pattern documented in [CWE-22].

Attack Vector

The attack is exploitable over the network by any authenticated user. The attacker crafts a request to the cache file serving endpoint that includes traversal sequences resolving to a sibling directory beginning with cache. The resolved absolute path passes the flawed startswith check, and the server returns the requested file contents. No user interaction is required and exploitation complexity is low.

No public proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-j2c8-v969-8r5c for further technical details.

Detection Methods for CVE-2026-54014

Indicators of Compromise

Requests to the cache file serving endpoint containing parent-directory traversal sequences such as .. or URL-encoded variants %2e%2e.
HTTP 200 responses from the cache endpoint returning files whose paths resolve outside the configured CACHE_DIR.
Access patterns from a single authenticated session enumerating multiple files under directories named cache_backup, cache_sibling, or cached_models.

Detection Strategies

Review Open WebUI access logs for requests to cache endpoints with abnormal path components or encoded traversal characters.
Compare the deployed Open WebUI version against the fixed release 0.9.6 to identify exposed instances.
Instrument the reverse proxy or web application firewall to flag and log requests matching path traversal signatures targeting cache routes.

Monitoring Recommendations

Enable verbose request logging on Open WebUI and forward logs to a centralized analytics platform for retention and correlation.
Alert on authenticated sessions issuing large volumes of cache endpoint requests within short time windows.
Monitor filesystem read activity for the Open WebUI process accessing paths outside the intended CACHE_DIR.

How to Mitigate CVE-2026-54014

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.9.6 or later, which contains the corrected containment check.
Audit directories adjacent to CACHE_DIR and remove or relocate any directory whose name begins with cache to a non-sibling location until patched.
Restrict access to Open WebUI instances to trusted authenticated users while remediation is in progress.

Patch Information

The maintainers released the fix in Open WebUI 0.9.6. The corrected logic appends os.sep to the resolved cache directory before performing the startswith comparison, ensuring sibling directories sharing the cache prefix no longer satisfy the check. See the GitHub Security Advisory GHSA-j2c8-v969-8r5c for the official advisory and patch reference.

Workarounds

Deploy a reverse proxy rule that rejects requests to the cache endpoint containing .. sequences or URL-encoded traversal patterns.
Run Open WebUI under a dedicated filesystem user with read access limited strictly to the intended cache directory and no sibling paths.
Rename adjacent directories so that none share the cache prefix with the configured CACHE_DIR, eliminating the bypass surface until the upgrade is applied.

bash

# Configuration example: NGINX rule to block traversal attempts on the cache endpoint
location ~* /cache/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://openwebui_backend;
}