Affected: open-webui

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, a path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authenticated user to read files from sibling directories outside the intended cache directory, by exploiting an incomplete startswith containment check that lacks a trailing path separator. The root cause is that serve_cache_file() in open_webui/main.py validates the resolved path with file_path.startswith(os.path.abspath(CACHE_DIR)) — without appending os.sep. This allows any path resolving to a sibling directory whose name begins with cache (e.g. cache_sibling, cache_backup, cached_models) to pass validation. This vulnerability is fixed in 0.9.6.

Affected: PyPI: open-webui

## Summary

A path traversal vulnerability exists in open-webui's cache file serving endpoint that allows any authenticated user to read files from sibling directories outside the intended cache directory, by exploiting an incomplete `startswith` containment check that lacks a trailing path separator.

The root cause is that `serve_cache_file()` in `open_webui/main.py` validates the resolved path with `file_path.startswith(os.path.abspath(CACHE_DIR))` — without appending `os.sep`. This allows any path resolving to a sibling directory whose name begins with `cache` (e.g. `cache_sibling`, `cache_backup`, `cached_models`) to pass validation.

Deep traversal and absolute paths are correctly blocked. The bypass is narrow but confirmed — limited to sibling-prefix directories.

### Exploitation constraints

| Constraint | Detail | |---|---| | Auth required | `get_verified_user` — any user with role `user` or `admin` | | Scope | Only sibling directories starting with `cache` (e.g. `cache_backup`, `cached_models`) | | Deep traversal | Blocked — `../../etc/passwd` correctly fails the startswith check | | Absolute paths | Blocked — `/etc/passwd` correctly fails | | Client normalization | httpx/browsers normalize `..` client-side — must use raw HTTP or ASGI to deliver payload |

## Vulnerability Details

### Vulnerable function: `serve_cache_file()`

```python # open_webui/main.py, line 2907-2924 @app.get('/cache/{path:path}') async def serve_cache_file(path: str, user=Depends(get_verif…