CVE-2024-7033: Arbitrary File Write in open-webui/open-webui
In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's filesystem. This can result in overwriting critical system or application files, causing denial of service, or potentially achieving remote code execution (RCE). RCE can allow an attacker to execute malicious code with the privileges of the user running the application, leading to a full system compromise.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7033?
CVE-2024-7033 has a medium severity rating due to its potential for arbitrary file writing on affected systems.
How do I fix CVE-2024-7033?
To mitigate CVE-2024-7033, upgrade the open-webui application to version 0.3.9 or later where the vulnerability is patched.
What versions of open-webui are affected by CVE-2024-7033?
CVE-2024-7033 affects version 0.3.8 and earlier of the open-webui application.
What platforms are impacted by CVE-2024-7033?
CVE-2024-7033 specifically impacts the open-webui application when deployed on Windows.
Can CVE-2024-7033 lead to remote code execution?
While CVE-2024-7033 allows arbitrary file writing, it does not directly indicate the ability to execute remote code.