CVE-2024-7038
| CVE ID | CVE-2024-7038 |
| Vendor Disposition | Rejected, out of scope |
| Official Resolution | Withdrawn by the issuing CNA on 2026-07-16; the record is REJECTED |
| Published | 2024-10-09 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | Low (CVSS 2.7, CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) |
The issuing CNA has withdrawn the record, so the official CVE entry now carries the REJECTED state and NVD and downstream feeds inherit it. The public record now matches Open WebUI's vendor disposition below, confirming our assessment that this was not a genuine vulnerability. There is no advisory and no affected Open WebUI release.
Timeline
This CVE was withdrawn by its issuing CNA after review. Open WebUI's assessment below is the basis on which the record was rejected.
| Date | Event |
|---|---|
| 2024-10-09 | huntr / Protect AI publishes the CVE. |
| 2026-07-08 | Open WebUI publishes this disposition, rejecting the report as out of scope. |
| 2026-07-08 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-07-16 | Officially rejected huntr / Protect AI accepts the dispute and withdraws the record. The CVE record is now officially REJECTED. |
| Still open | The huntr report page has not followed the withdrawal. The report is still shown as Valid with a green check and its status as "Awaiting fix", while the CVE field on the same page reads Rejected. |
| 2026-08-08 | Open WebUI asks huntr / Protect AI to bring the report validity and fix status in line with the withdrawal, and to make those fields follow CVE state transitions so it does not recur. Awaiting response. |
| 2026-08-14 | With huntr / Protect AI unresponsive on that request, Open WebUI raises the matter with the CVE Program, asking that records withdrawn by the CNA no longer be presented as valid and awaiting a fix. CNA Rule 4.5.2.3 states that a CNA's published vulnerability information "MUST generally support and MUST NOT contradict information published by the CNA in corresponding CVE Records". |
The record is now in the REJECTED state on cve.org, and that state propagates to NVD and downstream feeds. No action is required from users, and the CVE should not be treated as an Open WebUI vulnerability.
What the CVE Claims
The report, titled "File Name enumeration leads to information disclosure", concerns the embedding-model update feature under admin settings. When an administrator submits an embedding model path (POST /rag/api/v1/embedding/update, the embedding_model field), the application tries to load it and returns a different error message depending on whether the path exists. The report states that an administrator can submit crafted paths such as ../../../../tmp/testing/test.txt and, by observing which error comes back, determine whether arbitrary files exist and enumerate directories on the server. It is classified as CWE-209 (error message containing sensitive information).
Why This Is Out of Scope
The endpoint, POST /rag/api/v1/embedding/update (the update_embedding_config handler), is gated by Depends(get_admin_user). Only an administrator can call it. This was true in the reported version (v0.3.8) and remains true today. The report's own CVSS vector scores this as PR:H (high privileges required): the only party who can trigger these error messages is an administrator.
An Administrator Inspecting Their Own Server Crosses No Boundary
The entire "disclosure" is an administrator learning whether a file exists on a server they operate. One party appears in the report, the report has that party inspecting their own machine, and nothing passes between two of them at any point.
Administrators already have complete, direct access to that filesystem. In every supported deployment they have server access, whether explicit (shell, container or host access) or implicit through the application: administrators can install Tools and Functions, which execute arbitrary Python on the server by design (see Rule 10), and can therefore list any directory and read any file outright, in one step. Against that, inferring one bit ("does this path exist?") from an error message discloses nothing new. It is a slower, weaker way to observe filesystem state the administrator already has full access to. There is only one party here, the administrator, and they already have all of it.
There is no path by which an unprivileged user reaches this endpoint.
Applicable Security Policy Rules
- Rule 9: The action requires an administrator, inspecting a server they operate. Administrators have full system control, including direct filesystem access.
- Rule 1: No security boundary is crossed. A vulnerability must cross at least one security boundary; an administrator observing the filesystem of a server they operate crosses none.
- Rule 7: The report does not account for Open WebUI's self-hosted, role-based architecture, in which administrators are trusted operators with full server access.
Impact to Users
No action required. The endpoint is reachable only by administrators, who already have full visibility of the server's filesystem through supported functionality. There is no exposure to unprivileged users.