An authenticated user who has terminal server access can craft path values that include encoded "../" traversal sequences, bypassing the intended path restrictions on the terminal server. The untrusted input is the request path parameter, not an administrator‑configured value, which means the attack relies on user‑controlled data. The flaw permits reading or modifying files on the terminal‑server host and, where the server forwards requests to internal services, it also allows SSRF. The vulnerability originates from weaknesses in input validation and path handling (CWE-22 and CWE-918) and could enable attackers to compromise confidentiality, integrity, and potentially execute malicious code on the server.

The issue affects all versions of the open-webui open-webui product released prior to 0.9.6. The problem was remedied in release 0.9.6 by adding proper path sanitization. Users of earlier releases should verify their instance version to determine exposure.

With a CVSS score of 7.7 the flaw is classified as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because exploitation requires an authenticated user with terminal‑server privileges, the threat is limited to those accounts. The attacker supplies a specially crafted path in the terminal‑server request, thus the vector is through the web UI. If an attacker can gain terminal‑server access, the risk of unauthorized file disclosure or SSRF is significant.