CVE-2024-7034

Advisory

Affected versions of the open-webui package are vulnerable to Arbitrary File Overwrite due to improper input validation of user-supplied filenames. The /models/upload endpoint constructs file paths using file_path = f"{UPLOAD_DIR}/{file.filename}" without sanitizing the file.filename parameter, allowing directory traversal sequences to escape the intended upload directory. An attacker can exploit this vulnerability by crafting malicious filenames containing path traversal sequences to overwrite arbitrary files on the system, potentially modifying system binaries, configuration files, or sensitive data to achieve remote code execution.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-crh6-pj8c-xrhc
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7034