CVE-2024-7043

🗓️ 20 Mar 2025 10:10:40Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 79 Views🌐 WEB

Improper access control in open-webui v0.3.8 allows unauthorized file viewing and deletion.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2024-7043	20 Mar 202511:26	–	circl
CNNVD	Open WebUI 安全漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-7043 Improper Access Control in open-webui/open-webui	20 Mar 202510:10	–	cvelist
EUVD	EUVD-2025-6966	3 Oct 202520:07	–	euvd
Github Security Blog	Open WebUI Allows Arbitrary File Reading and Deletion	20 Mar 202512:32	–	github
NVD	CVE-2024-7043	20 Mar 202510:15	–	nvd
OSV	CVE-2024-7043 Improper Access Control in open-webui/open-webui	20 Mar 202510:10	–	osv
OSV	GHSA-JRHC-9QG9-4QFQ Open WebUI Allows Arbitrary File Reading and Deletion	20 Mar 202512:32	–	osv
OSV	PYSEC-2026-1737 Open WebUI Allows Arbitrary File Reading and Deletion	7 Jul 202614:34	–	osv
Positive Technologies	PT-2025-12179	20 Mar 202500:00	–	ptsecurity

NVD

Node

openwebui open_webuiMatch0.3.8

[
  {
    "vendor": "open-webui",
    "product": "open-webui/open-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/c01e0c7f-68d8-45cf-91d2-521c97f33b00

Parameter	Position	Path	Description	CWE
file_id	path	/api/v1/files/{file_id}	Unauthorized retrieval of information for a specific file due to missing access control checks	CWE-862, CWE-821
file_id	path	/api/v1/files/{file_id}	Unauthorized deletion of a file due to missing access control checks	CWE-862, CWE-821

17 Jun 2026 08:19Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.8

CVSS 38.1

EPSS0.00563

SSVC