CVE-2024-7037
| CVE ID | CVE-2024-7037 |
| Vendor Disposition | Rejected, out of scope |
| Published | 2024-10-09 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | Medium (CVSS 6.5, CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) |
Open WebUI does not execute pipelines. A pipeline is Python that runs on a separate Pipelines server, a distinct application an administrator chooses to deploy and connect. The /api/v1/pipelines/upload endpoint executes nothing at all: it saves the file to a local cache and forwards it to that administrator's own server. A filesystem write in Open WebUI's cache therefore cannot lead to code execution in Open WebUI, and where pipeline code does run, it runs because an administrator deployed the server, connected it and uploaded the code deliberately.
The endpoint is administrator-only, which the record's own vector concedes with PR:H. Taken purely as a write, it is an administrator writing to a host they already control completely through the server and database access the role carries. No boundary is crossed and no capability is gained.
This is not a subtle finding that reasonable reviewers could differ on. The endpoint is a proxy, its administrator gate is stated in the record's own CVSS vector, and the component that executes code is a separate product. A record was nonetheless minted, scored 6.5 Medium, and filed against the wrong project altogether: the impact it describes belongs to an application Open WebUI does not ship, does not run and does not control. Identifying the affected product is the CVE Record's primary function, and this record does not do it. It has stood against this project for nearly two years.
Timeline
Open WebUI rejects this record as not a vulnerability; the assessment below is the project's official position. The issuing CNA has not responded and has not acted on the record, so the dispute has been escalated to the CVE Program Root.
| Date | Event |
|---|---|
| 2024-10-09 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as out of scope. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
As of 2026-08-08, the record is still in the PUBLISHED state on cve.org and the dispute is before the CVE Program Root. This disposition stands as Open WebUI's official assessment.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, the /api/v1/pipelines/upload endpoint concatenates file.filename with CACHE_DIR without sanitization, so a crafted filename can traverse the path and write or delete files outside the intended directory, "potentially leading to remote code execution." The record classifies this as CWE-22 (Path Traversal) and scores it CVSS 6.5 (Medium).
Why This Is Out of Scope
This report is a full-blown category error, and it misplaces the code execution it warns about.
Pipelines do not run in Open WebUI. A pipeline is Python that executes on a separate Pipelines server (the pipelines package), a distinct application that an administrator optionally deploys and connects to Open WebUI as an OpenAI-compatible connection. Open WebUI's /api/v1/pipelines/upload endpoint executes nothing: it requires Depends(get_admin_user), saves the administrator's .py to a local cache, and forwards it to that administrator's connected Pipelines server (POST {url}/pipelines/upload) for that server to run. This is the case at the cited version. The record's own CVSS vector concedes the administrator gate with PR:H.
The Remote Code Execution the Report Warns Of Is Not in Open WebUI
The record frames the filesystem write as potentially leading to remote code execution. It cannot lead to remote code execution in Open WebUI, because Open WebUI does not execute uploaded pipelines: the file is written to a cache and forwarded, and nothing in Open WebUI runs it. Where pipeline code does execute, on the separate Pipelines server, it does so because an administrator deployed that server, connected it, and uploaded code to it deliberately. That is the feature operating as designed, on a different application, at the administrator's own direction. Neither location is an Open WebUI code-execution vulnerability.
The Write Is an Administrator Manipulating a Host They Already Control
Taken purely as a filesystem write, the endpoint lets an administrator write or overwrite a file on the Open WebUI host through an unsanitized filename. The only actor who can reach it is an administrator. An administrator already controls the deployment: they can read, write, or delete any file on the host through the server and database access the role carries, and they can stand up and connect a Pipelines server that runs arbitrary code. A write reachable only by that same administrator crosses no privilege boundary and grants no capability the administrator does not already hold. (Current releases additionally normalize the name with os.path.basename and reject non-.py files. The disposition does not rest on that: the endpoint is administrator-only and is a proxy to a separate execution server regardless.)
CWE-22 Is Misapplied
CWE-22 describes an untrusted actor reaching the filesystem across a boundary. There is no untrusted actor here and no boundary: the endpoint is administrator-only, and it forwards code to a separate server the administrator chose to run. Naming the filename as the threat, on an administrator-only proxy to an administrator-operated execution server, is a category error.
Applicable Security Policy Rules
- Rule 1: A vulnerability must cross a security boundary. An administrator managing an administrator-deployed Pipelines server through a dedicated admin-only endpoint is expected behavior and crosses none.
- Rule 3: The report does not reflect an accurate understanding of the codebase or of how Open WebUI is used: it places remote code execution in Open WebUI, when Open WebUI forwards the file to a separate Pipelines server and never executes it.
- Rule 7: The report applies an external-attacker threat model to a self-hosted, single-trust-domain, admin-governed feature whose only actor is an administrator operating their own deployment.
- Rule 9: Administrators have full system control. The upload, and any file write reachable through this admin-only endpoint, is an administrator action against a host and a connected server the administrator already controls. Out of scope.
- Rule 10: Administrator-supplied Python code execution is intended behavior; the pipelines feature is that design, carried out on the connected Pipelines server rather than inside Open WebUI.
- Rule 13: The only actor is an administrator, and the write affects the host and the Pipelines server that same administrator operates, not a party other than the actor.
Impact to Users
No action required. The pipeline-upload endpoint is administrator-only, and it forwards uploaded code to a separate Pipelines server that the administrator deploys and connects. Open WebUI does not execute pipeline code. An administrator can already write files on the host and run code on their connected Pipelines server by design, so a filesystem write reachable through the same admin-only upload grants nothing the administrator does not already have.