CVE-2026-59221 Open WebUI vulnerability
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass normalization checks and be decoded by the upstream terminal server. This issue is fixed in version 0.10.0.
Quick answer
Open WebUI should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- Open WebUI >=0.9.6 <0.10.0
Fixed versions
- 0.10.0
How to fix it
CVE-2026-59221 affects Open WebUI versions from 0.9.6 before 0.10.0 in the terminal proxy path sanitizer. A user with access to an existing configured terminal connection can bypass traversal checks with repeatedly encoded ../ path segments and cause Open WebUI to forward requests outside the intended normalized proxy path. Upgrade Open WebUI to 0.10.0 or later. Until patched, restrict terminal connection access and disable terminal proxy features that are not required.
- Inventory Open WebUI deployments, containers, terminal-server integrations, reverse proxies, and configured terminal connections.
- Identify Open WebUI versions from 0.9.6 before 0.10.0 and prioritize deployments where users can access configured terminal connections.
- Upgrade Open WebUI to 0.10.0 or a later supported release and redeploy all containers or services using the vulnerable image.
- Restrict terminal connection access to trusted users and disable unused terminal proxy integrations until the upgrade is complete.
- Review reverse proxy rules, upstream terminal server paths, policy IDs, and Open WebUI role assignments for unnecessary reachability.
- Review Open WebUI, terminal-server, and reverse proxy logs for deeply percent-encoded traversal attempts or unexpected parent-route access.
- If unauthorized terminal proxy access is suspected, rotate terminal credentials, revoke sessions/API keys, and preserve request logs before cleanup.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm Open WebUI reports version 0.10.0 or a later supported release across every deployment.
- Confirm 9x and 10x encoded traversal payloads are rejected and cannot be forwarded to upstream terminal routes.
- Confirm terminal proxy access is limited to intended users and no unused terminal connections remain enabled.
- Review logs after patching for blocked traversal attempts and unexpected upstream route access.
- Document patched image digests, role changes, terminal connection inventory, and test evidence.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-59221?
Open WebUI versions listed as affected should be reviewed: Open WebUI >=0.9.6 <0.10.0.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.