Arbitrary Directory Creation in browser-use web-ui Affects Versions 2.0.0 to 3.0.0

CVE-2026-82637

What is CVE-2026-82637?

The browser-use web-ui versions 2.0.0 through 3.0.0 contain a significant vulnerability that fails to properly validate paths for browser settings during the execution of run_agent_task. This flaw permits malicious actors to specify absolute paths through parameters such as save_recording_path, save_trace_path, save_agent_history_path, or save_download_path. Through the unauthenticated Gradio interface, an attacker could exploit this vulnerability to create directories in any location where the root-running container has the necessary write permissions, leading to unauthorized file system modifications.

References