Security Advisory

CVE-2024-7037

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2024-10-09 19:52:21

Last updated 2024-10-10 14:57:57

Assigner @huntr_ai

State PUBLISHED

Description

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

← Browse all CVEs View on cve.org ↗