Threats tagged 'ghsa-r2wg-2mcr-66rv'

An authenticated user with access to a terminal server in open-webui can exploit a path traversal and SSRF vulnerability via crafted encoded path segments. The vulnerability arises because the terminal-server reverse proxy does not fully sanitize user-controlled path inputs before forwarding them, allowing traversal outside intended scopes. A double-encoding technique bypasses the existing sanitization, enabling access to unintended files or internal services. This affects open-webui versions prior to 0.9.6.