CVE-2024-7037 — MEDIUM (CVSS 6.5) AI Security Vulnerability

Q: Is CVE-2024-7037 actively exploited?

No confirmed active exploitation of CVE-2024-7037 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2024-7037?

1. Update open-webui immediately to a version beyond 0.3.8. 2. If patching is delayed, block /api/pipelines/upload at the WAF or reverse proxy layer. 3. Audit existing pipeline files in CACHE_DIR for unexpected content or path-traversal artifacts. 4. Enforce strong unique admin credentials and restrict admin access to trusted IPs. 5. Monitor CACHE_DIR parent directories for unexpected file creation or modification via filesystem auditing (auditd, inotify). 6. Limit Docker volume mounts to the minimum required — avoid mounting host paths writable by the app container.

Q: What systems are affected by CVE-2024-7037?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM deployments, AI pipeline systems, model serving, agent frameworks.

Q: What is the CVSS score for CVE-2024-7037?

CVE-2024-7037 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 2.28%.

CISO Take

Any user with admin credentials on open-webui <= 0.3.8 can overwrite system files via a crafted upload filename, achieving remote code execution. Despite the Medium CVSS rating, treat this as critical for internal AI deployments — shared admin credentials are endemic in AI/ML teams. Update immediately or block access to the pipeline upload endpoint at the network layer.

Risk Assessment

CVSS 6.5 underrepresents operational risk. The High Privilege requirement is the only meaningful barrier, and AI teams routinely share admin credentials or run open-webui with minimal access controls on internal networks. Path traversal-to-RCE is a trivial, well-documented exploit chain requiring no AI/ML expertise. Deployments exposed beyond localhost — even on internal networks — should be treated as high severity.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
open-webui	pip	<= 0.3.8	No patch
135.3K Pushed 8d ago 58% patched ~9d to patch Full package profile →

Do you use open-webui? You're affected.

Severity & Risk

CVSS 3.1

6.5 / 10

EPSS

2.3%

chance of exploitation in 30 days

Higher than 85% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR High

UI None

S Unchanged

C None

I High

A High

Recommended Action

6 steps

Update open-webui immediately to a version beyond 0.3.8.
If patching is delayed, block /api/pipelines/upload at the WAF or reverse proxy layer.
Audit existing pipeline files in CACHE_DIR for unexpected content or path-traversal artifacts.
Enforce strong unique admin credentials and restrict admin access to trusted IPs.
Monitor CACHE_DIR parent directories for unexpected file creation or modification via filesystem auditing (auditd, inotify).
Limit Docker volume mounts to the minimum required — avoid mounting host paths writable by the app container.

CISA SSVC Assessment

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Code Execution Supply Chain Framework Plugin AML.T0010.001 - AI Software AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0072 - Reverse Shell

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.4 - AI system design and development security

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain value of deployed AI systems

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2024-7037?

Any user with admin credentials on open-webui <= 0.3.8 can overwrite system files via a crafted upload filename, achieving remote code execution. Despite the Medium CVSS rating, treat this as critical for internal AI deployments — shared admin credentials are endemic in AI/ML teams. Update immediately or block access to the pipeline upload endpoint at the network layer.

Is CVE-2024-7037 actively exploited?

No confirmed active exploitation of CVE-2024-7037 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-7037?

1. Update open-webui immediately to a version beyond 0.3.8. 2. If patching is delayed, block /api/pipelines/upload at the WAF or reverse proxy layer. 3. Audit existing pipeline files in CACHE_DIR for unexpected content or path-traversal artifacts. 4. Enforce strong unique admin credentials and restrict admin access to trusted IPs. 5. Monitor CACHE_DIR parent directories for unexpected file creation or modification via filesystem auditing (auditd, inotify). 6. Limit Docker volume mounts to the minimum required — avoid mounting host paths writable by the app container.

What systems are affected by CVE-2024-7037?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM deployments, AI pipeline systems, model serving, agent frameworks.

What is the CVSS score for CVE-2024-7037?

CVE-2024-7037 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 2.28%.

Technical Details

NVD Description

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.

Exploitation Scenario

An attacker obtains admin credentials via credential stuffing, phishing, or password reuse common in AI/ML teams. They send a POST to /api/pipelines/upload with a filename crafted as '../../etc/cron.d/backdoor' or '../../usr/local/lib/python3.x/site-packages/malicious.py'. The server concatenates the unsanitized filename with CACHE_DIR and writes attacker-controlled content to the resolved path. The cron variant schedules a reverse shell; the Python module variant injects malicious code executed during the next LLM inference request. Standard tooling (curl, Burp Suite) suffices — no AI/ML knowledge required.