File and Path Handling

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. Open WebUI Arbitrary File Upload + Path TraversalCVE-2024-6707Open WebUI · CVSS 7.5 · 1.0% likely

   CWE-22

2. Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`CVE-2026-28786open-webui · CVSS 4.3 · 0.6% likely

   CWE-22

3. open-webui terminal proxy path traversal guard bypass via 9x encoded traversalCVE-2026-59221open-webui · CVSS 7.7 · 0.5% likely

   CWE-22

4. Open WebUI: Open WebUI Arbitrary File Write, Delete via Path TraversalCVE-2026-44565open-webui · CVSS 8.1 · 0.5% likely

   CWE-22

5. Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversalCVE-2026-54017open-webui · CVSS 7.7 · 0.4% likely

   CWE-22

6. Open WebUI: Sibling-Prefix Path Traversal via /cache/{path} in open-webui/open-webuiCVE-2026-54014open-webui · CVSS 4.3 · 0.4% likely

   CWE-22

7. Open WebUI: Arbitrary File Upload and Path TraversalCVE-2026-44566open-webui · CVSS 7.3 · 0.3% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.