4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54014

CVE-2026-54014: Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authenticated user to read files from sibling directories outside the intended cache directory, by exploiting an incomplete startswith containment check that lacks a trailing path separator. The root cause is that serve_cache_file() in open_webui/main.py validates the resolved path with file_path.startswith(os.path.abspath(CACHE_DIR)) — without appending os.sep. This allows any path resolving to a sibling directory whose name begins with cache (e.g. cache_sibling, cache_backup, cached_models) to pass validation. This vulnerability is fixed in 0.9.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54014

CVE-2026-54014:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	pip	<= 0.9.5	0.9.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the serve_cache_file function, located in backend/open_webui/main.py. The core of the issue is an improper path validation check. The code uses file_path.startswith(os.path.abspath(CACHE_DIR)) to ensure that file access is restricted to the designated cache directory. However, this check is flawed because it doesn't enforce a trailing path separator.

This oversight allows for a path traversal attack. An attacker can craft a path that navigates to a sibling directory of the cache directory, as long as the sibling directory's name starts with "cache". For example, if the cache directory is /data/cache, an attacker could use a path like ../cache_evil/some_file to access files in the /data/cache_evil directory. The os.path.abspath resolves this to /data/cache_evil/some_file, and the startswith("/data/cache") check incorrectly passes because "cache_evil" starts with "cache".

The patch addresses this by adding a trailing separator to the check: file_path.startswith(os.path.abspath(CACHE_DIR) + os.sep). This ensures that only paths within the intended cache directory are allowed, effectively closing the traversal vulnerability. The vulnerable function serve_cache_file is the primary runtime indicator for this CVE.

Vulnerable functions

serve_cache_file

backend/open_webui/main.py

The function `serve_cache_file` is vulnerable to path traversal because it validates file paths using `startswith` without a trailing slash. This allows an attacker to access files in sibling directories that have a prefix matching the cache directory name (e.g., `cache_backup`). The vulnerability is triggered when a user makes a request to the `/cache/{path}` endpoint with a crafted path like `../cache_sibling/secret.txt`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.