CVE-2024-7037
| CVE ID | CVE-2024-7037 |
| Vendor Disposition | Rejected, out of scope |
| Published | 2024-10-09 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | Medium (CVSS 6.5, CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) |
Open WebUI does not execute pipelines. A pipeline is Python that runs on a separate Pipelines server, a distinct application an administrator chooses to deploy and connect. The /api/v1/pipelines/upload endpoint executes nothing at all: it saves the file to a local cache and forwards it to that administrator's own server. A filesystem write in Open WebUI's cache therefore cannot lead to code execution in Open WebUI, and where pipeline code does run, it runs because an administrator deployed the server, connected it and uploaded the code deliberately.
The endpoint is administrator-only, which the record's own vector concedes with PR:H. Taken purely as a write, it is an administrator writing to a host they already control completely through the server and database access the role carries. No boundary is crossed and no capability is gained.
The endpoint forwards what it receives, the administrator gate is stated in the record's own CVSS vector, and the component that runs the code is a separate product. The record was nonetheless minted, scored 6.5 Medium, and filed against the wrong project altogether: the impact it describes belongs to an application Open WebUI does not ship, does not run and does not control. Identifying the affected product is the CVE Record's primary function, and this record does not do it. It has stood against this project for nearly two years.
The issuing CNA has withdrawn the record, so the official CVE entry now carries the REJECTED state and NVD and downstream feeds inherit it. The public record now matches Open WebUI's vendor disposition below, confirming our assessment that this was not a genuine vulnerability. There is no advisory and no affected Open WebUI release.
Timeline
This CVE was withdrawn by its issuing CNA after the dispute was escalated to the CVE Program. Open WebUI's assessment below is the basis on which the record was rejected.
| Date | Event |
|---|---|
| 2024-10-09 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as out of scope. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
| 2026-08-12 | The CVE Program opens a formal dispute with huntr / Protect AI under CVE Program Rule 4.1 (Vulnerability Determination) and requests the CNA's response. |
| 2026-08-12 | huntr / Protect AI replies to the CVE Program and agrees to withdraw the record. |
| 2026-08-13 | Officially rejected The record is updated on cve.org. The CVE record is now officially REJECTED. |
| Still open | The huntr report page has not followed the withdrawal. The report is still shown as Valid with a green check and its status as "Awaiting fix", while the CVE field on the same page reads Rejected. |
| 2026-08-14 | With the report status unchanged, Open WebUI raises the matter with the CVE Program, asking that records withdrawn by the CNA no longer be presented as valid and awaiting a fix. CNA Rule 4.5.2.3 states that a CNA's published vulnerability information "MUST generally support and MUST NOT contradict information published by the CNA in corresponding CVE Records". |
The record is now in the REJECTED state on cve.org, and that state propagates to NVD and downstream feeds. No action is required from users, and the CVE should not be treated as an Open WebUI vulnerability.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, the /api/v1/pipelines/upload endpoint concatenates file.filename with CACHE_DIR without sanitization, so a crafted filename can traverse the path and write or delete files outside the intended directory, "potentially leading to remote code execution." The record classifies this as CWE-22 (Path Traversal) and scores it CVSS 6.5 (Medium).
Why This Is Out of Scope
The record places the code execution inside Open WebUI. Open WebUI writes the file to a cache and forwards it, and never runs it.
Pipelines do not run in Open WebUI. A pipeline is Python that executes on a separate Pipelines server (the pipelines package), a distinct application that an administrator optionally deploys and connects to Open WebUI as an OpenAI-compatible connection. Open WebUI's /api/v1/pipelines/upload endpoint executes nothing: it requires Depends(get_admin_user), saves the administrator's .py to a local cache, and forwards it to that administrator's connected Pipelines server (POST {url}/pipelines/upload) for that server to run. This is the case at the cited version. The record's own CVSS vector concedes the administrator gate with PR:H.
The Remote Code Execution the Report Warns Of Is Not in Open WebUI
The record frames the filesystem write as potentially leading to remote code execution. It cannot lead to remote code execution in Open WebUI, because Open WebUI does not execute uploaded pipelines: the file is written to a cache and forwarded, and nothing in Open WebUI runs it. Where pipeline code does execute, on the separate Pipelines server, it does so because an administrator deployed that server, connected it, and uploaded code to it deliberately. That is the feature operating as designed, on a different application, at the administrator's own direction. Neither location is an Open WebUI code-execution vulnerability.
The Write Is an Administrator Manipulating a Host They Already Control
Taken purely as a filesystem write, the endpoint lets an administrator write or overwrite a file on the Open WebUI host through an unsanitized filename. The only actor who can reach it is an administrator. An administrator already controls the deployment: they can read, write, or delete any file on the host through the server and database access the role carries, and they can stand up and connect a Pipelines server that runs arbitrary code. A write reachable only by that same administrator crosses no privilege boundary and grants no capability the administrator does not already hold. (Current releases additionally normalize the name with os.path.basename and reject non-.py files. The disposition does not rest on that: the endpoint is administrator-only and is a proxy to a separate execution server regardless.)
CWE-22 Is Misapplied
CWE-22 describes an untrusted actor reaching the filesystem across a boundary. There is no untrusted actor here and no boundary: the endpoint is administrator-only, and it forwards code to a separate server the administrator chose to run. Naming the filename as the threat, on an administrator-only proxy to an administrator-operated execution server, is a category error.
Applicable Security Policy Rules
- Rule 1: A vulnerability must cross a security boundary. An administrator managing an administrator-deployed Pipelines server through a dedicated admin-only endpoint is expected behavior and crosses none.
- Rule 3: The report does not reflect an accurate understanding of the codebase or of how Open WebUI is used: it places remote code execution in Open WebUI, when Open WebUI forwards the file to a separate Pipelines server and never executes it.
- Rule 7: The report applies an external-attacker threat model to a self-hosted, single-trust-domain, admin-governed feature whose only actor is an administrator operating their own deployment.
- Rule 9: Administrators have full system control. The upload, and any file write reachable through this admin-only endpoint, is an administrator action against a host and a connected server the administrator already controls. Out of scope.
- Rule 10: Administrator-supplied Python code execution is intended behavior; the pipelines feature is that design, carried out on the connected Pipelines server rather than inside Open WebUI.
- Rule 13: The only actor is an administrator, and the write affects the host and the Pipelines server that same administrator operates, not a party other than the actor.
Impact to Users
No action required. The pipeline-upload endpoint is administrator-only, and it forwards uploaded code to a separate Pipelines server that the administrator deploys and connects. Open WebUI does not execute pipeline code. An administrator can already write files on the host and run code on their connected Pipelines server by design, so a filesystem write reachable through the same admin-only upload grants nothing the administrator does not already have.