CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation
Attackers can create arbitrary directories via unauthenticated Gradio interface due to lack of path validation in browser settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82637?
CVE-2026-82637 is a medium-severity path traversal vulnerability in browser-use web-ui, published on 30 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.
Weakness: CWE-73
Which versions are affected by CVE-2026-82637?
How do I fix CVE-2026-82637?
No fix has been published for CVE-2026-82637 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-82637 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82637 exists.
Sources
Also known as GHSA-hhqw-gcq9-6cmv.