CVE-2026-54014
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In Open WebUI prior to version 0.9.6, a path traversal vulnerability exists in the cache file serving endpoint that allows authenticated users to read files from sibling directories outside the intended cache directory.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data stored in sibling directories, posing a significant security risk to the organization.
Recommendation
It is recommended to update Open WebUI to version 0.9.6 or later to mitigate this vulnerability.
Other vulnerabilities in Open WebUI
See all- CVE-2026-45350High
In Open WebUI prior to version 0.8.6, there is a vulnerability in the chat completion API that allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access.
- CVE-2026-45338High
In Open WebUI prior to version 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the _process_picture_url() function, allowing an attacker to force the server to make HTTP requests to internal resources.
- CVE-2026-45315High
Open WebUI prior to version 0.9.3 has a vulnerability that allows audio files with HTML extensions to be uploaded, potentially leading to the execution of malicious code in users' browsers. A user with the appropriate permissions can trick others into opening a malicious link.
- CVE-2026-45303High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.5 allowed for script injection and execution through the HTML rendering view. The chat content was embedded in an iFrame with sandbox restrictions that were largely ineffective.
- CVE-2026-45301High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.3.16 had a missing permission check in files related to API endpoints. This allowed any authenticated user to list, access, and delete every file uploaded by other users.
- CVE-2026-44570High
In Open WebUI prior to version 0.6.19, there were inconsistencies in authorization controls surrounding the memories API, allowing standard users to delete, restore, and view the contents of other users' memories.
- CVE-2026-44569High
In Open WebUI prior to version 0.6.19, there is an IDOR vulnerability in the channels message management system that allows authenticated users to modify or delete any message within channels they have access to. The issue arises from a lack of message ownership validation in the message update and delete endpoints.
- CVE-2026-44567High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.1.124 did not properly validate whether a user has an authorized role. By default, when new user sign-ups are enabled, the user role is set to 'pending', requiring administrator intervention to assign the appropriate role.
- CVE-2026-44566High
Open WebUI is an artificial intelligence platform that prior to version 0.1.124 did not validate or sanitize file names uploaded by users. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended upload directory.
- CVE-2026-44565High
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.6.10 did not validate or sanitize file names when uploading audio files. This allows users to upload files with names containing dot-segments, enabling traversal out of the intended uploads directory.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authenticated user to read files from sibling directories outside the intended cache directory, by exploiting an incomplete startswith containment check that lacks a trailing path separator. The root cause is that serve_cache_file() in open_webui/main.py validates the resolved path with file_path.startswith(os.path.abspath(CACHE_DIR)) — without appending os.sep. This allows any path resolving to a sibling directory whose name begins with cache (e.g. cache_sibling, cache_backup, cached_models) to pass validation. This vulnerability is fixed in 0.9.6.