CVE-2024-7034
| CVE ID | CVE-2024-7034 |
| Vendor Disposition | Rejected, out of scope |
| Official Resolution | Withdrawn by the issuing CNA on 2026-07-16; the record is REJECTED |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | Medium (CVSS 6.5, CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) |
The issuing CNA has withdrawn the record, so the official CVE entry now carries the REJECTED state and NVD and downstream feeds inherit it. The public record now matches Open WebUI's vendor disposition below, confirming our assessment that this was not a genuine vulnerability. There is no advisory and no affected Open WebUI release.
Timeline
This CVE was withdrawn by its issuing CNA after review. Open WebUI's assessment below is the basis on which the record was rejected.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-08 | Open WebUI publishes this disposition, rejecting the report as out of scope. |
| 2026-07-08 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-07-16 | Officially rejected huntr / Protect AI accepts the dispute and withdraws the record. The CVE record is now officially REJECTED. |
| Still open | The huntr report page has not followed the withdrawal. The report is still shown as Valid with a green check and its status as "Awaiting fix", while the CVE field on the same page reads Rejected. |
| 2026-08-08 | Open WebUI asks huntr / Protect AI to bring the report validity and fix status in line with the withdrawal, and to make those fields follow CVE state transitions so it does not recur. Awaiting response. |
| 2026-08-14 | With huntr / Protect AI unresponsive on that request, Open WebUI raises the matter with the CVE Program, asking that records withdrawn by the CNA no longer be presented as valid and awaiting a fix. CNA Rule 4.5.2.3 states that a CNA's published vulnerability information "MUST generally support and MUST NOT contradict information published by the CNA in corresponding CVE Records". |
The record is now in the REJECTED state on cve.org, and that state propagates to NVD and downstream feeds. No action is required from users, and the CVE should not be treated as an Open WebUI vulnerability.
What the CVE Claims
The report is titled "Remote Code Execution due to Arbitrary File Write". It claims that POST /ollama/models/upload builds its destination path as file_path = f"{UPLOAD_DIR}/{file.filename}" without sanitizing the user-supplied filename, so an uploader can set file.filename to a directory-traversal sequence such as ../../../../../../tmp/pwned and write outside the upload directory. The report then argues that overwriting configuration files or binaries this way can be escalated to remote code execution. It is classified as CWE-22 (path traversal).
Why This Is Out of Scope
The endpoint, POST /ollama/models/upload (the upload_model handler), is gated by Depends(get_admin_user). Only an administrator can call it. This was true in the reported version (v0.3.8) and remains true today. The report's own CVSS vector scores this as PR:H (high privileges required): the uploader is an administrator.
An Administrator Can Already Write Any File and Run Any Code
The finding grants an administrator no capability they do not already have. An administrator operates the server. In every supported deployment they have server access, whether explicit (shell, container or host access) or implicit through the application itself: administrators can install Tools and Functions, which execute arbitrary Python on the server by design (see Rule 10). That is already arbitrary file write and arbitrary code execution, directly and by intent.
Against that baseline, a traversal in an admin-only upload endpoint that lets an administrator write a file outside UPLOAD_DIR is not a new capability. It is a longer route to something an administrator can already do in one line. The report's escalation to "remote code execution" is circular: an administrator already has code execution on the instance as a designed feature, so reaching it through an arbitrary file write changes nothing about the trust model. There is no path by which an unprivileged user reaches this endpoint.
Applicable Security Policy Rules
- Rule 9: The action requires an administrator. Administrators have full system control, including server-level file access and code execution, and are expected to understand the implications of their actions.
- Rule 10: The "remote code execution" the report escalates to is functionality administrators already have. Running code on the server via Tools and Functions is intended behavior.
- Rule 7: The report does not account for Open WebUI's self-hosted, role-based architecture, in which administrators are trusted operators of the server.
Impact to Users
No action required. The endpoint is reachable only by administrators, who already have full control of the server and its filesystem through supported functionality. There is no exposure to unprivileged users.