CVE-2026-54017 | open-webui OpenWebUI up to 0.9.5 Reverse Proxy terminals.py path traversal (GHSA-r2wg-2mcr-66rv)

A vulnerability described as critical has been identified in open-webui OpenWebUI up to 0.9.5. This affects an unknown part of the file backend/open_webui/routers/terminals.py of the component Reverse Proxy Handler. Executing a manipulation can lead to path traversal.

This vulnerability is handled as CVE-2026-54017. The attack can be executed remotely. There is not any exploit available.

Upgrading the affected component is recommended.