diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py
index 2c1cbf227a..6250dd947e 100644
--- a/backend/open_webui/main.py
+++ b/backend/open_webui/main.py
@@ -2935,7 +2935,10 @@ async def serve_cache_file(
     XSS from user-generated HTML stored in the cache directory.
     """
     file_path = os.path.abspath(os.path.join(CACHE_DIR, path))
-    if not file_path.startswith(os.path.abspath(CACHE_DIR)):
+    # trailing os.sep is required: without it, a path resolving to a sibling
+    # whose name starts with the cache-dir basename (e.g. cache_backup) passes
+    cache_root = os.path.abspath(CACHE_DIR) + os.sep
+    if not file_path.startswith(cache_root):
         raise HTTPException(status_code=404, detail='File not found')
     if not os.path.isfile(file_path):
         raise HTTPException(status_code=404, detail='File not found')