Vulnerability in open-webui/open-webui Allows Arbitrary File Write and Delete, Potentially Leading to Remote Code Execution

CVE-2024-7037

What is CVE-2024-7037?

The Open-WebUI application v0.3.8 is susceptible to an arbitrary file write and delete vulnerability due to insufficient sanitization of file inputs. Specifically, the vulnerable endpoint at /api/pipelines/upload allows for the unvalidated concatenation of uploaded file names with a sensitive system directory, CACHE_DIR. This flaw could enable adversaries to overwrite existing files or delete critical system files, which could allow for broader exploitation, including potential remote code execution.

References