The vulnerability arises in Open WebUI, where the function _sanitize_proxy_path decodes a proxy path only eight times. An attacker can craft a path containing nine percent‑encoded '..' fragments that bypass the check, allowing the upstream terminal server to resolve the path and access files outside the intended directory. This results in directory traversal with potential reading of arbitrary local files or execution of commands if the terminal server permits it. The weakness matches CWE-22 and CWE-918.

The flaw exists in Open WebUI versions 0.9.6 through all releases prior to 0.10.0. Any deployment of the open-webui product running these versions is vulnerable.

With a CVSS score of 7.7 the flaw is classified as high severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via an exposed terminal proxy endpoint; success requires the attacker to access that endpoint and use knowledge of percent‑encoding. Consequently, the risk is moderate to high for exposed deployments, particularly where the terminal server runs with elevated privileges.