Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Open WebUI

CVE-2024-7037: open-webui allows writing and deleting arbitrary files

mediumCVSS 4.0 5.5 · 3.0 6.5GHSA-54f4-v6v9-9q82

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHEDIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

Published Oct 9, 2024

Affected packages

open-webui

Ecosystem
PyPI
Affected
<= 0.3.8
Fixed in
No patched version yet
Check
pip show open-webui

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Open WebUI vulnerabilities

All Open WebUI entries