Every CVESearch/Get API key

CVE-2024-7037

open-webui allows writing and deleting arbitrary files

5.5 MediumRejected

CVE-2024-7037 has been rejected by its source and should not be treated as a live vulnerability, published October 9, 2024.

What does this mean?
Severity
5.5 MediumCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Affected packages

Affected packages
PackageAffectedFixed
open-webui
PyPI
through 0.3.8None known
open-webui
PyPI
through 0.3.8, plus listed versions
0.1.1240.1.1250.2.00.2.10.2.2
Show 11 moreShow less
0.2.30.2.40.2.50.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.7
None known

What each source reports

GitHub Advisories Score usedGHSA-54f4-v6v9-9q825.5

open-webui allows writing and deleting arbitrary files

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

Record
GHSA-54f4-v6v9-9q82
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
CVE ListNo score

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
CVE-2024-7037
Updated
2026-11-02
EUVDEUVD-2024-29416.5

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
EUVD-2024-2941
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
NVDNo score

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Record
CVE-2024-7037
Updated
2026-11-02
OSV6.5

Arbitrary File Write/Delete Leading to RCE in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

Record
CVE-2024-7037
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-54f4-v6v9-9q825.5

open-webui allows writing and deleting arbitrary files

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

Record
GHSA-54f4-v6v9-9q82
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVPYSEC-2026-17215.5

open-webui allows writing and deleting arbitrary files

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

Record
PYSEC-2026-1721
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open