CVE-2026-82637: Browser Use arbitrary directory

CISO Take

browser-use web-ui, a popular Python framework for running browser-automation AI agents, fails to validate file system paths supplied to its run_agent_task function, letting anyone who can reach the Gradio interface create directories at arbitrary locations by passing absolute paths into save_recording_path, save_trace_path, save_agent_history_path, or save_download_path. The interface is unauthenticated by design in typical deployments, so any network-reachable instance is exploitable with zero privileges and no user interaction, and since these containers commonly run as root, the blast radius extends to anywhere on the filesystem the process can write. The CVSS 5.3 rating and integrity-only impact (no confidentiality or availability loss per the vector) reflect that this is a directory-creation primitive rather than arbitrary file write or code execution, but it is still a useful foothold for filesystem pollution, path collision attacks, or staging for a follow-on exploit chain — no public exploit or scanner template exists yet and it is not in CISA KEV. Security teams running browser-use web-ui (v2.0.0-3.0.0) should upgrade past v3.0.0, ensure the Gradio interface is never exposed directly to untrusted networks (put it behind authentication or a VPN/reverse-proxy allowlist), and run the container as a non-root user to cap the impact of any path-based write primitive.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium risk. Attack complexity is low and no authentication or user interaction is required, but the impact is constrained to directory creation (CWE-73) rather than arbitrary file content write or remote code execution, matching the CVSS 3.1 vector (C:N/I:L/A:N). Real-world severity is driven almost entirely by deployment posture: instances that expose the Gradio UI directly to the internet or an internal network without authentication are trivially reachable, while instances that gate the UI behind auth or a private network see the practical risk drop close to zero. No EPSS data, KEV listing, public exploit, or Nuclei template exists, indicating this is not (yet) being actively targeted.

How does the attack unfold?

Initial Access

Attacker connects to the unauthenticated Gradio web interface of a browser-use web-ui deployment reachable over the network.

AML.T0049

Exploitation

Attacker submits a run_agent_task request with an absolute path in save_recording_path, save_trace_path, save_agent_history_path, or save_download_path, which the app fails to validate.

Impact

The root-running container creates a directory at the attacker-chosen location anywhere it has filesystem write access, enabling filesystem pollution or staging for a follow-on attack.

Initial Access

Attacker connects to the unauthenticated Gradio web interface of a browser-use web-ui deployment reachable over the network.

AML.T0049

Exploitation

Attacker submits a run_agent_task request with an absolute path in save_recording_path, save_trace_path, save_agent_history_path, or save_download_path, which the app fails to validate.

Impact

The root-running container creates a directory at the attacker-chosen location anywhere it has filesystem write access, enabling filesystem pollution or staging for a follow-on attack.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Browser Use	pip	—	No patch
111.7K 73 dependents Pushed today 50% patched ~0d to patch Full package profile →

Do you use Browser Use? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I Low

A None

What should I do?

1 step

Upgrade browser-use web-ui beyond v3.0.0 once a patched release addressing this path validation gap is available; track the upstream GitHub issue (#737) for the fix. Until patched, do not expose the Gradio interface to untrusted networks — place it behind authentication (reverse proxy with basic auth/SSO) or restrict access to a private network/VPN, since the interface has no built-in auth. Run the container as a non-root, least-privilege user so any directory-creation primitive cannot reach sensitive host or system paths. Add server-side validation/allowlisting of save_recording_path, save_trace_path, save_agent_history_path, and save_download_path to reject absolute paths or paths that escape the configured output directory. For detection, monitor for unexpected directory creation outside the app's data volume and audit Gradio access logs for anomalous run_agent_task calls with unusual path parameters.

How is it classified?

Auth Bypass DoS Agent Framework AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM07 - Insecure Plugin/Tool Design

Frequently Asked Questions

What is CVE-2026-82637?

browser-use web-ui, a popular Python framework for running browser-automation AI agents, fails to validate file system paths supplied to its run_agent_task function, letting anyone who can reach the Gradio interface create directories at arbitrary locations by passing absolute paths into save_recording_path, save_trace_path, save_agent_history_path, or save_download_path. The interface is unauthenticated by design in typical deployments, so any network-reachable instance is exploitable with zero privileges and no user interaction, and since these containers commonly run as root, the blast radius extends to anywhere on the filesystem the process can write. The CVSS 5.3 rating and integrity-only impact (no confidentiality or availability loss per the vector) reflect that this is a directory-creation primitive rather than arbitrary file write or code execution, but it is still a useful foothold for filesystem pollution, path collision attacks, or staging for a follow-on exploit chain — no public exploit or scanner template exists yet and it is not in CISA KEV. Security teams running browser-use web-ui (v2.0.0-3.0.0) should upgrade past v3.0.0, ensure the Gradio interface is never exposed directly to untrusted networks (put it behind authentication or a VPN/reverse-proxy allowlist), and run the container as a non-root user to cap the impact of any path-based write primitive.

Is CVE-2026-82637 actively exploited?

No confirmed active exploitation of CVE-2026-82637 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-82637?

Upgrade browser-use web-ui beyond v3.0.0 once a patched release addressing this path validation gap is available; track the upstream GitHub issue (#737) for the fix. Until patched, do not expose the Gradio interface to untrusted networks — place it behind authentication (reverse proxy with basic auth/SSO) or restrict access to a private network/VPN, since the interface has no built-in auth. Run the container as a non-root, least-privilege user so any directory-creation primitive cannot reach sensitive host or system paths. Add server-side validation/allowlisting of save_recording_path, save_trace_path, save_agent_history_path, and save_download_path to reject absolute paths or paths that escape the configured output directory. For detection, monitor for unexpected directory creation outside the app's data volume and audit Gradio access logs for anomalous run_agent_task calls with unusual path parameters.

What systems are affected by CVE-2026-82637?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, browser automation agents.

What is the CVSS score for CVE-2026-82637?

CVE-2026-82637 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

agent frameworksbrowser automation agents

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

Exploitation Scenario

An attacker scans for internet- or intranet-exposed browser-use web-ui Gradio instances (a common self-hosted AI agent tool for browser automation). Finding one with no authentication in front of it, they submit a run_agent_task request with save_trace_path or save_download_path set to an absolute path like /etc/some-service/ or a path inside another application's expected directory tree. Because the root-running container honors the path without validation, the target directory is created. The attacker repeats this against multiple sensitive locations to probe writable paths, map the container's filesystem permissions, or pre-stage directories that a subsequent vulnerability (in this or another component) could use to write or overwrite files, escalating what starts as a low-impact primitive into a step in a larger compromise chain.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path Primary

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.