CVE-2024-7033: Arbitrary File Write in open-webui/open-webui
First published: Thu Mar 20 2025(Updated: )
In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the download_model endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's filesystem. This can result in overwriting critical system or application files, causing denial of service, or potentially achieving remote code execution (RCE). RCE can allow an attacker to execute malicious code with the privileges of the user running the application, leading to a full system compromise.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| open-webui | ||
| pip/open-webui | <=0.3.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7033?
CVE-2024-7033 has a medium severity rating due to its potential for arbitrary file writing on affected systems.
How do I fix CVE-2024-7033?
To mitigate CVE-2024-7033, upgrade the open-webui application to version 0.3.9 or later where the vulnerability is patched.
What versions of open-webui are affected by CVE-2024-7033?
CVE-2024-7033 affects version 0.3.8 and earlier of the open-webui application.
What platforms are impacted by CVE-2024-7033?
CVE-2024-7033 specifically impacts the open-webui application when deployed on Windows.
Can CVE-2024-7033 lead to remote code execution?
While CVE-2024-7033 allows arbitrary file writing, it does not directly indicate the ability to execute remote code.
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3p9q-7w63-3f8q
- alias/CVE-2024-7033
- collector/nvd-cve
- agent/references
- agent/source
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- vendor/open-webui
- canonical/open-webui
- package-manager/pip