Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in "backend/open_webui/routers/terminals.py" does not fully confine the user-controlled "path" segment before forwarding it to an admin-configured terminal server. An authenticated user who has been granted access to a terminal server can craft "path" values containing encoded "../" traversal sequences that escape the intended path (or policy) scope on that server, reaching unintended endpoints and files on the terminal-server host. Where the terminal server fans requests out to internal services, this also gives SSRF-style reach into those services. This is a separate code path from the "/api/v1/retrieval/process/web" SSRF (GHSA-c6xv-rcvw-v685), with its own input. Two distinct vectors are consolidated here: first, raw path forwarding / single-encoded traversal (original report); and second, a bypass of the subsequently-added "_sanitize_proxy_path" mitigation using double-encoded dots ("%252e%252e"). The attacker-controlled input is the request "path", supplied by the non-admin user, not anything an administrator configures, so this is not an admin-trust / Rule-9 situation. Version 0.9.6 fixes the issue.