CVE-2024-8060
| CVE ID | CVE-2024-8060 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | High (CVSS 8.1, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) |
The single attacker-influenced value is file.filename.split(".")[-1], the text after the final dot. A token produced by splitting on . cannot itself contain a ., so it can never contain the .. that a traversal requires. The name written to disk is a server-generated UUID under a fixed directory regardless.
Both facts are visible in the five lines of code the report itself quotes. There is no version of Open WebUI in which this traversal was possible, so there was nothing to introduce and nothing to fix. The record is published as a High-severity path traversal leading to remote code execution as root, scored 8.1.
This is not a subtle finding that reasonable reviewers could differ on. The code that refutes it is the code the report quotes, and it refutes it in a single line. A record was nonetheless minted, scored 8.1 High, and published against this project, where it has stood for over a year.
Timeline
Open WebUI rejects this record as not a vulnerability; the assessment below is the project's official position. The issuing CNA has not responded and has not acted on the record, so the dispute has been escalated to the CVE Program Root.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
As of 2026-08-08, the record is still in the PUBLISHED state on cve.org and the dispute is before the CVE Program Root. This disposition stands as Open WebUI's official assessment.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.0, the audio transcription endpoint /audio/api/v1/transcriptions is claimed to perform insufficient validation on file.content_type and to allow user-controlled filenames, producing a path traversal by which an authenticated user could overwrite critical files in the container and achieve remote code execution as root. The record classifies this as CWE-22 (Path Traversal) and scores it CVSS 8.1 (High).
Why This Is Not a Vulnerability
The premise is factually incorrect: the uploaded file's name is never used as the on-disk name. In the cited version the handler generates the destination name itself:
ext = file.filename.split(".")[-1]
id = uuid.uuid4()
filename = f"{id}.{ext}"
file_dir = f"{CACHE_DIR}/audio/transcriptions"
file_path = f"{file_dir}/{filename}"The on-disk name is a server-generated UUID under a fixed directory. The only attacker-influenced component is ext.
The Attacker-Controlled Part Cannot Traverse
ext is file.filename.split(".")[-1], the substring after the final dot. Because it is a split-on-"." segment, it cannot contain a dot at all, and therefore cannot contain the .. sequence a traversal requires. The UUID is also a literal prefix on the final path component ({id}.{ext}), so ext cannot begin the component either. At most ext could contain a forward slash, which would place the file in a subdirectory beneath the transcriptions directory, never above it.
There is consequently no traversal primitive, no way for a write to escape the transcriptions cache directory, and no arbitrary-file overwrite. The claimed container-file overwrite and root remote code execution cannot occur. Because the destination has always been a server-generated UUID under a fixed path, there was no traversal to introduce and none to fix.
CWE-22 Is Misapplied
Path traversal requires a user-controlled pathname reaching a filesystem sink. Here the pathname is a server-generated UUID under a constant directory, and the single user-influenced token is structurally incapable of containing ... The weakness the report describes does not exist in the code.
Applicable Security Policy Rules
- Rule 1: A vulnerability must be a real, exploitable weakness. The reported traversal does not exist: the on-disk name is a server-generated UUID, and the only user-influenced component cannot contain a traversal sequence.
Impact to Users
No action required. Uploaded transcription files are stored under a server-generated UUID name in a fixed cache directory. The reported path traversal, file overwrite, and remote code execution cannot occur.