PT-2025-12179 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-07-18 · CVE-2024-7043

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8

Description The issue allows attackers to view and delete any files due to improper access control. The application fails to verify whether the attacker is an administrator, enabling them to directly call the "GET /api/v1/files/" interface to retrieve information on all files uploaded by users, including the ID values. Attackers can then use the "GET /api/v1/files/{file id}" interface to obtain information on any file and the "DELETE /api/v1/files/{file id}" interface to delete any file.

Recommendations For open-webui/open-webui version 0.3.8, consider restricting access to the GET /api/v1/files/ interface and implementing proper access control to prevent unauthorized file deletion and viewing until a patch is available. As a temporary workaround, restrict access to the DELETE /api/v1/files/{file id} interface to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-821

CWE-862

Related Identifiers

CVE-2024-7043

GHSA-JRHC-9QG9-4QFQ

Affected Products

Open-Webui

References · 7

• 🔥 https://huntr.com/bounties/c01e0c7f-68d8-45cf-91d2-521c97f33b00 · Exploit
• https://osv.dev/vulnerability/GHSA-jrhc-9qg9-4qfq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7043 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7043 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/1902671088020074972 · Twitter Post
• https://t.me/cvenotify/129506 · Telegram Post