CVE-2024-6707: Open Webui Path Traversal Vulnerability

CVE-2024-6707 Overview

CVE-2024-6707 is a path traversal vulnerability in Open WebUI version 0.1.105 that allows authenticated attackers to upload attacker-controlled files to arbitrary locations on the web server's filesystem. The flaw is tracked under CWE-22, Improper Limitation of a Pathname to a Restricted Directory. KoreLogic disclosed the issue in security advisory KL-001-2024-006. Open WebUI is a self-hosted web interface commonly deployed to interact with local large language model (LLM) runtimes. Successful exploitation can lead to remote code execution by writing files into directories executed by the web server or its dependencies.

Critical Impact
Authenticated attackers can write arbitrary files outside the intended upload directory, enabling code execution and full compromise of the host running Open WebUI.

Affected Products

Open WebUI 0.1.105
Debian Linux 12.0 (packages bundling the affected version)
Self-hosted Open WebUI deployments exposing the upload endpoint

Discovery Timeline

2024-08-07 - CVE-2024-6707 published to the National Vulnerability Database (NVD)
2024-08-08 - Advisory shared via the Full Disclosure mailing list and OSS-Security by KoreLogic
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6707

Vulnerability Analysis

The vulnerability resides in an Open WebUI file upload handler that fails to normalize and validate user-supplied filename or path components before writing data to disk. An authenticated user can submit an upload request containing relative path sequences such as ../ in the filename or path field. The application concatenates this value with a base directory and calls a file write operation without enforcing that the resolved path remains within the intended upload root.

Because the network attack vector requires only low-privilege authentication and no user interaction, any registered account on a vulnerable instance can reach the sink. The impact spans confidentiality, integrity, and availability: an attacker can overwrite configuration files, plant web-accessible payloads, or replace Python modules loaded by the application server.

Root Cause

The root cause is missing canonicalization and containment checks on attacker-controlled path data. The upload handler trusts client-supplied filenames and joins them directly to a destination directory. Without resolving the final path and verifying it is a descendant of the allowed directory, traversal sequences escape the upload sandbox.

Attack Vector

Exploitation requires network access to the Open WebUI instance and valid credentials. An attacker sends a crafted multipart upload request whose filename or path parameter embeds traversal sequences pointing to a sensitive destination such as the application's source directory, a cron drop-in path, or a web-served static directory. Once the file is written, the attacker triggers execution by requesting the file through the web server, restarting the service, or waiting for a scheduled task to load the planted artifact.

No public proof-of-concept exploit is listed in the CVE record. Technical specifics are documented in the KoreLogic Security Advisory KL-001-2024-006 and the Full Disclosure Mailing List Post.

Detection Methods for CVE-2024-6707

Indicators of Compromise

Files written outside the configured Open WebUI uploads directory, particularly under application source paths, static/, or user home directories.
HTTP requests to Open WebUI upload endpoints containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths in filename fields.
Unexpected new .py, .html, .js, or shell script files appearing in directories owned by the Open WebUI service account.
Process executions spawned by the Open WebUI service that do not match its normal child process tree.

Detection Strategies

Inspect reverse proxy and application access logs for POST requests to upload routes carrying traversal patterns in form data or headers.
Enable filesystem integrity monitoring on the Open WebUI install directory and any web-served static directories to flag unauthorized writes.
Correlate upload events with subsequent file executions or service restarts using endpoint detection and response (EDR) telemetry.

Monitoring Recommendations

Forward Open WebUI, reverse proxy, and host audit logs to a centralized analytics platform and alert on traversal signatures in upload parameters.
Monitor the Open WebUI service account for writes outside its expected upload directory and for execution of newly created files.
Track outbound network connections from the Open WebUI host to detect post-exploitation command-and-control activity.

How to Mitigate CVE-2024-6707

Immediate Actions Required

Upgrade Open WebUI to a release later than 0.1.105 that addresses the path traversal flaw, following guidance in the KoreLogic advisory.
Restrict network access to Open WebUI to trusted users and management networks until patched.
Disable self-registration and audit existing accounts to limit the population of authenticated users who can reach the upload endpoint.
Review the Open WebUI install directory and web-served paths for unexpected files written since the deployment date.

Patch Information

The NVD entry for CVE-2024-6707 lists Open WebUI 0.1.105 as the affected version and does not enumerate a fixed version in the published references. Administrators should consult the Open WebUI release notes and upgrade to the latest stable release. Debian users on debian_linux 12.0 should apply distribution package updates when available.

Workarounds

Place Open WebUI behind an authenticating reverse proxy that filters request bodies containing .. or absolute path sequences in filename fields.
Run the Open WebUI service under a dedicated low-privilege user with write access limited to the uploads directory via filesystem ACLs or AppArmor/SELinux profiles.
Mount the uploads directory with noexec and isolate the application root on a read-only filesystem layer where feasible.
Remove unused accounts and rotate credentials for any users who do not require upload capability.