Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Published: 2024-10-09
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-2941 In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.
Github GHSA Github GHSA GHSA-54f4-v6v9-9q82 open-webui allows writing and deleting arbitrary files
References

No reference.

History

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Arbitrary File Write/Delete Leading to RCE in open-webui/open-webui
CPEs cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*
Vendors & Products Open-webui
Open-webui open-webui
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
CPEs cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*
Vendors & Products Openwebui
Openwebui open Webui
References
Metrics cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Thu, 13 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Tue, 29 Jul 2025 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Openwebui
Openwebui open Webui
CPEs cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*
Vendors & Products Openwebui
Openwebui open Webui
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Thu, 10 Oct 2024 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Open-webui
Open-webui open-webui
CPEs cpe:2.3:a:open-webui:open-webui:*:*:*:*:*:*:*:*
Vendors & Products Open-webui
Open-webui open-webui
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 09 Oct 2024 20:00:00 +0000

Type Values Removed Values Added
Description In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.
Title Arbitrary File Write/Delete Leading to RCE in open-webui/open-webui
Weaknesses CWE-22
References
Metrics cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: REJECTED

Assigner: @huntr_ai

Published:

Updated: 2026-08-13T14:42:00.186Z

Reserved: 2024-07-23T17:48:28.192Z

Link: CVE-2024-7037

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2024-10-09T20:15:09.477

Modified: 2026-08-13T15:18:20.560

Link: CVE-2024-7037

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.