What is CVE-2024-7037?

CVE-2024-7037 is a high-severity vulnerability in Open-webui Open-webui/open-webui, classified under Path Traversal. CVSS score: 7.2/10. Published 2024-10-09.

How severe is CVE-2024-7037?

High severity. CVSS v3 base score is 7.2 out of 10.

Path Traversal in Open-webui Open-webui/open-webui

CVE-2024-7037

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.010 (59.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Open-webui Open-webui/open-webui — versions unspecified
Openwebui Open_webui — versions 0.3.8

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-7037?: CVE-2024-7037 is a high-severity vulnerability in Open-webui Open-webui/open-webui, classified under Path Traversal. CVSS score: 7.2/10. Published 2024-10-09.
How severe is CVE-2024-7037?: High severity. CVSS v3 base score is 7.2 out of 10.