CVE-2026-82637: browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation
browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
browser-use web-uito a version that resolves this vulnerability.Fixed in 3.0.0 - Compensating control
Restrict network access to the unauthenticated Gradio interface (e.g., allowlist only trusted sources at the firewall/ingress) to prevent exploitation of the directory-creation issue in browser-use web-ui 2.0.0 through 3.0.0.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running browser-use web-ui versions 2.0.0 through 3.0.0 are exposed if their Gradio interface is reachable by an attacker. The impact is greatest when the application runs in a root-running container, because directories can be created anywhere that container can write.
What does an attacker need to exploit it?
An attacker needs network access to the unauthenticated Gradio interface. They can supply an absolute path through save_recording_path, save_trace_path, save_agent_history_path, or save_download_path when invoking run_agent_task.
Are default path restrictions sufficient to prevent exploitation?
No path validation is performed for the affected browser settings parameters in run_agent_task. Absolute paths allow directory creation outside an expected application-controlled location, subject to the container's write permissions.
How can I check whether my deployment is affected?
Check whether browser-use web-ui is version 2.0.0 through 3.0.0 and whether its Gradio interface permits unauthenticated access. Review calls to run_agent_task and filesystem activity for directories created at unexpected absolute paths, particularly from the four save-path parameters.
What can be done if patching is not immediately possible?
Restrict access to the Gradio interface so untrusted users cannot submit requests. Run the container without root privileges and limit its writable filesystem locations to reduce the locations where directories can be created.