The terminal-server reverse proxy in open-webui's backend does not adequately sanitize the user-controlled path segment before forwarding requests to the terminal server. Initially, single-encoded traversal sequences allowed escaping the intended path scope, but this was mitigated by a single URL decode and normalization check. However, a double-encoded payload (%252e%252e) bypasses this check because the sanitization decodes only once, allowing the upstream terminal server to decode it again and perform path traversal. This leads to CWE-22 (Path Traversal) and CWE-918 (SSRF) vulnerabilities, enabling authenticated users with terminal server access to reach unauthorized files or internal services. The recommended fix is to iteratively decode the path until stable before normalization and validation, preventing any depth of encoding from bypassing the check.

An authenticated user with granted access to a terminal server can escape the intended path or policy scope on that server, accessing unintended endpoints and files. Additionally, if the terminal server proxies requests to internal services, this vulnerability enables SSRF-style access to those services. The impact includes unauthorized information disclosure and potential internal service interaction without integrity or availability impact.

A fix is available in open-webui version 0.9.6 and later that properly sanitizes the proxy path by decoding it repeatedly until stable before normalization and validation. Users should upgrade to version 0.9.6 or later to remediate this vulnerability. Until upgraded, no reliable workaround exists because the vulnerability exploits double-encoded traversal sequences that bypass current sanitization.