Evidence

CVE-2026-59221 (GHSA-FRVJ-C5QP-XJ4W)

open-webui/open-webui

Published Jul 24, 2026HIGHCWE-22 CWE-918

PythonAI root causeIncomplete remediation

How AI contributed

Incomplete remediation

AI tried to fix this, but after eight unquote passes the function still forwarded a still-encoded path.

AI assistance was used to help inspect the code and prepare this report.

Only the highlighted steps are this advisory. The first card is the earlier flaw the AI tried, and failed, to close.

Original flaw

Earlier advisory · GHSA-R2WG-2MCR-66RV

The terminal proxy forwarded a user-controlled path after at most one unquote, so encoded ../ escaped the intended prefix.

Sink: backend/open_webui/routers/terminals.py

Originally written by a human commit

This advisoryCVE-2026-59221 (GHSA-FRVJ-C5QP-XJ4W)

AI tried to fix this

Replaced the single unquote with a decode-until-stable loop capped at eight.

The AI change was a real security patch, but it left the same advisory reachable.

Missed: After eight unquote passes the function still forwarded a still-encoded path.

Incomplete AI fix · Claude

0354775917

backend/open_webui/routers/terminals.py

Fixed again

Fail-closed if unquote still changed the path after the cap.

This is the patch that actually stops the same attack path.

AI-assisted fix: Claude Code · Classic298

05098d25a5

backend/open_webui/routers/terminals.py

Code comparison

Vulnerable code and fix

backend/open_webui/routers/terminals.py+8−1AI change

--- a/backend/open_webui/routers/terminals.py+++ b/backend/open_webui/routers/terminals.py@@ -35,7 +35,14 @@ def _sanitize_proxy_path(path: str) -> str | None: Trailing slashes are preserved — many upstream frameworks treat ``/path`` and ``/path/`` differently. """- decoded = unquote(path)+ # Decode until stable: a single unquote pass leaves %252e%252e as %2e%2e,+ # which the upstream then re-decodes into '..', bypassing the check below.+ decoded = path+ for _ in range(8):+ once = unquote(decoded)+ if once == decoded:+ break+ decoded = once had_trailing_slash = decoded.endswith('/') normalized = posixpath.normpath(decoded) # Remove any leading slashes that would reset the base

backend/open_webui/routers/terminals.py+3−0Fix

--- a/backend/open_webui/routers/terminals.py+++ b/backend/open_webui/routers/terminals.py@@ -43,6 +43,9 @@ def _sanitize_proxy_path(path: str) -> str | None: if once == decoded: break decoded = once+ # Fail closed: still encoded after the cap means the upstream would decode further into traversal.+ if unquote(decoded) != decoded:+ return None had_trailing_slash = decoded.endswith('/') normalized = posixpath.normpath(decoded) # Remove any leading slashes that would reset the base

Patch fingerprints

Candidate fac214325879070e293e4703181b559bd06bad89bcb9946368d5d8122561ecbf · Fix 340da6d19a901659899c210837a1ea26529a0fb18a58937e3b66ef4e84731372

Releases

Vulnerable: >= 0.9.6, < 0.10.0
Fixed: 0.10.0

GitHub advisory Repository advisory

Advisory references

Loading…

--- a/backend/open_webui/routers/terminals.py+++ b/backend/open_webui/routers/terminals.py@@ -35,7 +35,14 @@ def _sanitize_proxy_path(path: str) -> str | None: Trailing slashes are preserved — many upstream frameworks treat ``/path`` and ``/path/`` differently. """- decoded = unquote(path)+ # Decode until stable: a single unquote pass leaves %252e%252e as %2e%2e,+ # which the upstream then re-decodes into '..', bypassing the check below.+ decoded = path+ for _ in range(8):+ once = unquote(decoded)+ if once == decoded:+ break+ decoded = once had_trailing_slash = decoded.endswith('/') normalized = posixpath.normpath(decoded) # Remove any leading slashes that would reset the base

--- a/backend/open_webui/routers/terminals.py+++ b/backend/open_webui/routers/terminals.py@@ -43,6 +43,9 @@ def _sanitize_proxy_path(path: str) -> str | None: if once == decoded: break decoded = once+ # Fail closed: still encoded after the cap means the upstream would decode further into traversal.+ if unquote(decoded) != decoded:+ return None had_trailing_slash = decoded.endswith('/') normalized = posixpath.normpath(decoded) # Remove any leading slashes that would reset the base