Remote Code Execution due to Arbitrary File Write in open-webui/open-webui

Root

Cause

The /models/upload endpoint in Open WebUI version 0.3.8 constructs file paths using user-supplied filenames without validation or sanitization. Specifically, the code file_path = f"{UPLOAD_DIR}/{file.filename}" allows an attacker to include directory traversal sequences (e.g., ../) in the file.filename parameter, causing the resulting path to escape the intended upload directory [2].

Exploitation

An attacker can exploit this by sending a crafted multipart request to /models/upload with a filename containing traversal sequences. No authentication is required if the endpoint is exposed, making the attack surface broad. The vulnerability is publicly documented in a bug bounty report [3] and the project's repository [1] confirms the affected codebase.

Impact

Successful exploitation allows arbitrary file write on the server. An attacker could overwrite system binaries, configuration files, or sensitive data, potentially leading to remote command execution or complete compromise of the Open WebUI instance [2].

Mitigation

As of the publication date, users should monitor the Open WebUI project for a patched release. In the interim, restricting network access to the /models/upload endpoint and implementing input validation on filenames can reduce risk.