CVE-2024-7033

In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the download_model endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's filesystem. This can result in overwriting critical system or application files, causing denial of service, or potentially achieving remote code execution (RCE). RCE can allow an attacker to execute malicious code with the privileges of the user running the application, leading to a full system compromise.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/7078261f-8414-4bb7-9d72-a2a4d8bfd5d1	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-07-29 18:07

NVD link : CVE-2024-7033

Mitre link : CVE-2024-7033

CVE.ORG link : CVE-2024-7033

JSON object : View

Products Affected

openwebui

open_webui

CWE

CWE-29

Path Traversal: '\..\filename'

{"id": "CVE-2024-7033", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.2}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2025-03-20T10:15:34.987", "references": [{"url": "https://huntr.com/bounties/7078261f-8414-4bb7-9d72-a2a4d8bfd5d1", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-29"}]}], "descriptions": [{"lang": "en", "value": "In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the download_model endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's filesystem. This can result in overwriting critical system or application files, causing denial of service, or potentially achieving remote code execution (RCE). RCE can allow an attacker to execute malicious code with the privileges of the user running the application, leading to a full system compromise."}, {"lang": "es", "value": "En la versi\u00f3n 0.3.8 de open-webui/open-webui, existe una vulnerabilidad de escritura arbitraria en archivos en el endpoint download_model. Al implementarse en Windows, la aplicaci\u00f3n gestiona incorrectamente las rutas de archivo, lo que permite a un atacante manipularlas para escribir archivos en ubicaciones arbitrarias del sistema de archivos del servidor. Esto puede provocar la sobrescritura de archivos cr\u00edticos del sistema o de la aplicaci\u00f3n, lo que puede provocar una denegaci\u00f3n de servicio o incluso la ejecuci\u00f3n remota de c\u00f3digo (RCE). La RCE puede permitir que un atacante ejecute c\u00f3digo malicioso con los privilegios del usuario que ejecuta la aplicaci\u00f3n, lo que compromete completamente el sistema."}], "lastModified": "2025-07-29T18:07:55.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BFA5C2D-BD4F-4BD5-8D4E-D3BE4036FFA4"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}