CVE-2024-7037
CVSS 3.0 Score 6.5 of 10 (medium)
Details
Published Oct 9, 2024
Updated: Oct 10, 2024
CWE ID 22
Summary
CVE-2024-7037 is a critical vulnerability affecting open-webui version v0.3.8. The issue lies in the /api/pipelines/upload endpoint, which fails to sanitize user input for file.filename before appending it to the CACHE_DIR. This oversight allows attackers to perform arbitrary file writes and deletions, potentially resulting in the overwriting of critical system files and leading to remote code execution.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.