CVE-2024-8060: Remote Code Execution in OpenWebUI via Arbitrary File Upload
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint /audio/api/v1/transcriptions that allows for arbitrary file upload. The application performs insufficient validation on the file.contenttype and allows user-controlled filenames, leading to a path traversal vulnerability. This can be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to remote code execution as the root user.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/open-webuito a version that resolves this vulnerability.Fixed in 0.5.17
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8060?
CVE-2024-8060 is classified as a critical severity vulnerability due to its potential exploitation through arbitrary file uploads.
How do I fix CVE-2024-8060?
To address CVE-2024-8060, upgrade OpenWebUI to version 0.5.17 or later.
What specific component is affected by CVE-2024-8060?
CVE-2024-8060 affects the audio API endpoint `/audio/api/v1/transcriptions` in OpenWebUI version 0.3.0.
Can CVE-2024-8060 lead to remote code execution?
Yes, CVE-2024-8060 could potentially allow for remote code execution due to the ability for arbitrary file upload.
Is CVE-2024-8060 present in versions prior to 0.3.0?
CVE-2024-8060 does not apply to versions prior to 0.3.0, as it specifically affects version 0.3.0.