Moderate severityNVD Advisory· Published Oct 9, 2024· Updated Oct 10, 2024

Arbitrary File Write/Delete Leading to RCE in open-webui/open-webui

CVE-2024-7037

Description

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
open-webuiPyPI	<= 0.3.8	—

Affected products

ghsa-coords
pkg:pypi/open-webui
Range: <= 0.3.8
Openwebui/Open Webuicpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-54f4-v6v9-9q82ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-7037ghsaADVISORY
github.com/open-webui/open-webui/blob/main/backend/main.pyghsaWEB
huntr.com/bounties/8508db68-9c99-4b1c-828c-e1bfcacfb847ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000