Path traversal in Open WebUI - CVE-2026-44566
Published: May 6, 2026
Vulnerability identifier: #VU130238
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44566
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to upload files to arbitrary locations on the server filesystem.
The vulnerability exists due to path traversal in the /rag/api/v1/doc API route when processing uploaded file names in multipart form data. A remote attacker can send a specially crafted file upload request with dot-segments in the filename to upload files to arbitrary locations on the server filesystem.
The uploaded file is written with the permissions of the user running the web server.
Affected software
Open WebUI
How to mitigate CVE-2026-44566
Install security update from vendor's website.
Open WebUI - update to 0.1.124