CVE-2024-8060: OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint `/audio/api/v1/transcriptions` that allows for arbitrary file upload. The…

PriorityP354high8.1CVSS 3.0

AVNACLPRLUINSUCNIHAH

EPSS

0.88%

54.6th percentile

OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint `/audio/api/v1/transcriptions` that allows for arbitrary file upload. The application performs insufficient validation on the `file.content_type` and allows user-controlled filenames, leading to a path traversal vulnerability. This can be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to remote code execution as the root user.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
open-webui	open-webui	>= 0 < 0.5.17	0.5.17
open-webui	open-webui_open-webui	unspecified – latest	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.