CVE-2024-7037

🗓️ 09 Oct 2024 19:52:21Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 73 Views🌐 WEB

Open-webui Arbitrary File RCE Vulnerability in v0.3.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-7037	9 Oct 202423:11	–	circl
CNNVD	Open WebUI 路径遍历漏洞	9 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-7037 Arbitrary File Write/Delete Leading to RCE in open-webui/open-webui	9 Oct 202419:52	–	cvelist
EUVD	EUVD-2024-2941	3 Oct 202520:07	–	euvd
Github Security Blog	open-webui allows writing and deleting arbitrary files	9 Oct 202421:31	–	github
NVD	CVE-2024-7037	9 Oct 202420:15	–	nvd
OSV	GHSA-54F4-V6V9-9Q82 open-webui allows writing and deleting arbitrary files	9 Oct 202421:31	–	osv
Positive Technologies	PT-2024-38039 · Unknown · Open-Webui	9 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-7037	23 May 202510:41	–	redhatcve
Snyk	Path Traversal	9 Oct 202421:31	–	snyk

NVD

Vulnrichment

Node

openwebui open_webuiMatch0.3.8

[
  {
    "vendor": "open-webui",
    "product": "open-webui/open-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/8508db68-9c99-4b1c-828c-e1bfcacfb847

Parameter	Position	Path	Description	CWE
filename	request body	/api/pipelines/upload	Vulnerable upload endpoint due to unsanitized concatenation of file.filename with CACHE_DIR enabling arbitrary file write/delete.	CWE-22

29 Jul 2025 18:47Current

7High risk

Vulners AI Score7

CVSS 3.17.2

CVSS 36.5

EPSS0.02278

SSVC

CWE-22