Open WebUI: Sibling-Prefix Path Traversal via /cache/{path}