CVE-2024-6707 Open WebUI Arbitrary File Upload + Path Traversal
Attackers can upload malicious files to arbitrary server locations via path traversal, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6707?
CVE-2024-6707 is a high-severity path traversal vulnerability in Openwebui Open Webui, published on 7 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.
Which versions are affected by CVE-2024-6707?
It affects 1 product.
Products include Openwebui Open Webui.
How do I fix CVE-2024-6707?
No fix has been published for CVE-2024-6707 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-6707 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6707 exists.
Other vulnerabilities in Openwebui Open Webui
- CVE-2026-44551 Open WebUI: LDAP Empty Password Authentication Bypass
- CVE-2026-56400 open-webui - Remote Code Execution via CORS Misconfiguration and Session Validation
- CVE-2024-8017 Cross-site Scripting (XSS) in open-webui/open-webui
- CVE-2026-45672 Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed
- CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
Sources
Also known as GHSA-67jr-crfx-vm73.