CVE-2024-6707 Open WebUI Arbitrary File Upload + Path Traversal

2024-08-0723:04:45

CWE-434

CWE-22

KoreLogic

github.com

cve-2024-6707

open webui

arbitrary file upload

path traversal

attacker controlled files

web server filesystem

AI Score

Confidence

High

EPSS

0.001

Percentile

31.4%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

Attacker controlled files can be uploaded to arbitrary locations on the web server’s filesystem by abusing a path traversal vulnerability.

CNA Affected

[
  {
    "repo": "https://github.com/open-webui/open-webui",
    "vendor": "Open WebUI",
    "product": "Open WebUI",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.105"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:openwebui:open_webui:0.1.105:*:*:*:*:*:*:*"
    ],
    "vendor": "openwebui",
    "product": "open_webui",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.105"
      }
    ],
    "defaultStatus": "unknown"
  }
]