CVE-2024-8060
| CVE ID | CVE-2024-8060 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | High (CVSS 8.1, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) |
The single attacker-influenced value is file.filename.split(".")[-1], the text after the final dot. A token produced by splitting on . cannot itself contain a ., so it can never contain the .. that a traversal requires. The name written to disk is a server-generated UUID under a fixed directory regardless.
Both facts are visible in the five lines of code the report itself quotes. There is no version of Open WebUI in which this traversal was possible, so there was nothing to introduce and nothing to fix. The record is published as a High-severity path traversal leading to remote code execution as root, scored 8.1.
The code that refutes this is the code the report quotes, and it refutes it in a single line. The record was nonetheless minted, scored 8.1 High, and published against this project, where it has stood for over a year.
The issuing CNA has withdrawn the record, so the official CVE entry now carries the REJECTED state and NVD and downstream feeds inherit it. The public record now matches Open WebUI's vendor disposition below, confirming our assessment that this was not a genuine vulnerability. There is no advisory and no affected Open WebUI release.
Timeline
This CVE was withdrawn by its issuing CNA after the dispute was escalated to the CVE Program. Open WebUI's assessment below is the basis on which the record was rejected.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
| 2026-08-12 | The CVE Program opens a formal dispute with huntr / Protect AI under CVE Program Rule 4.1 (Vulnerability Determination) and requests the CNA's response. |
| 2026-08-12 | huntr / Protect AI replies to the CVE Program and agrees to withdraw the record. |
| 2026-08-13 | Officially rejected The record is updated on cve.org. The CVE record is now officially REJECTED. |
| Still open | The huntr report page has not followed the withdrawal. The report is still shown as Valid with a green check and its status as "Awaiting fix", while the CVE field on the same page reads Rejected. |
| 2026-08-14 | With the report status unchanged, Open WebUI raises the matter with the CVE Program, asking that records withdrawn by the CNA no longer be presented as valid and awaiting a fix. CNA Rule 4.5.2.3 states that a CNA's published vulnerability information "MUST generally support and MUST NOT contradict information published by the CNA in corresponding CVE Records". |
The record is now in the REJECTED state on cve.org, and that state propagates to NVD and downstream feeds. No action is required from users, and the CVE should not be treated as an Open WebUI vulnerability.
Disclosure Pathway
A report describing the same endpoint and the same sink, unrestricted file upload via /audio/api/v1/transcriptions, was filed through our GHSA channel on 2024-07-23, eight months before this CVE was published. That report did not describe path traversal or remote code execution; the escalation asserted in this record is not what was reported to us.
What the CVE Claims
In Open WebUI v0.3.0, the audio transcription endpoint /audio/api/v1/transcriptions is claimed to perform insufficient validation on file.content_type and to allow user-controlled filenames, producing a path traversal by which an authenticated user could overwrite critical files in the container and achieve remote code execution as root. The record classifies this as CWE-22 (Path Traversal) and scores it CVSS 8.1 (High).
Why This Is Not a Vulnerability
Nothing below rests on how Open WebUI draws its threat model, on configuration, or on where a security boundary is placed. It rests on what the cited code does, in the affected version as published, and it would hold under any threat model at all.
The premise is factually incorrect: the uploaded file's name is never used as the on-disk name. In the cited version the handler generates the destination name itself:
ext = file.filename.split(".")[-1]
id = uuid.uuid4()
filename = f"{id}.{ext}"
file_dir = f"{CACHE_DIR}/audio/transcriptions"
file_path = f"{file_dir}/{filename}"The on-disk name is a server-generated UUID under a fixed directory. The only attacker-influenced component is ext.
The Attacker-Controlled Part Cannot Traverse
ext is file.filename.split(".")[-1], the substring after the final dot. Because it is a split-on-"." segment, it cannot contain a dot at all, and therefore cannot contain the .. sequence a traversal requires. The UUID is also a literal prefix on the final path component ({id}.{ext}), so ext cannot begin the component either. At most ext could contain a forward slash, which would place the file in a subdirectory beneath the transcriptions directory, never above it.
There is consequently no traversal primitive, no way for a write to escape the transcriptions cache directory, and no arbitrary-file overwrite. The claimed container-file overwrite and root remote code execution cannot occur. Because the destination has always been a server-generated UUID under a fixed path, there was no traversal to introduce and none to fix.
CWE-22 Is Misapplied
Path traversal requires a user-controlled pathname reaching a filesystem sink. Here the pathname is a server-generated UUID under a constant directory, and the single user-influenced token is structurally incapable of containing ... The weakness the report describes does not exist in the code.
Applicable Security Policy Rules
- Rule 1: A vulnerability must be a real, exploitable weakness. The reported traversal does not exist: the on-disk name is a server-generated UUID, and the only user-influenced component cannot contain a traversal sequence.
- Rule 3: Reports must reflect an understanding of the affected components. The record claims the uploaded file keeps the name the sender chose, when the code the report itself quotes shows the server naming the file with an identifier it generates, inside a fixed directory.
Impact to Users
No action required. Uploaded transcription files are stored under a server-generated UUID name in a fixed cache directory. The reported path traversal, file overwrite, and remote code execution cannot occur.