CVE-2024-6707 is a high severity (CVSS 8.8) path traversal in Open WebUI, found in version 0.1.105, where attacker controlled files can be written to arbitrary locations on the server. KoreLogic's advisory says the fix shipped in v0.1.117, released 2024-04-03. Update to that or any later release.
What's affected
The record names Open WebUI 0.1.105 and Debian Linux 12.0 in its product list. The KoreLogic advisory names 0.1.105 as the tested version and does not state a full affected range.
The fixed version is v0.1.117, released on 2024-04-03, according to the advisory. KoreLogic reported the issue through GitHub's private security form on 2024-03-12 with a suggested patch. The maintainer merged it in a private fork before the release, and public disclosure came on 2024-08-07. The advisory lists CWE-22 and CWE-434 for the same issue.
How to check if you're exposed
Check the version of Open WebUI you run. For a Docker deployment, read the image tag. For a pip install:
pip show open-webui
Anything older than 0.1.117 should be treated as affected. Then look at what the service can write to. Open WebUI containers often run as root with a broad volume mount, which raises the stakes of a file write. Check which paths are mounted and which user the process runs as.
What to do now
- Upgrade Open WebUI to v0.1.117 or later, ideally to the current release.
- Run the service as a non-root user, with only the data directory writable.
- Do not expose the instance to the internet without authentication and a reverse proxy.
- Review the upload directory and nearby paths for files you do not recognise.
- Add the project to your dependency inventory so future advisories reach you.
Why it matters
The record lists CWE-22, path traversal, and CWE-434, unrestricted upload of a dangerous file type. The upload handler for the document route used the client supplied filename when it built the save path, and did not validate or sanitise it, so dot segments in the name could move a file out of the intended directory.
On its own, a file write is bad. On a server that runs AI tooling with broad access and stored API keys, it can lead to code execution, which is why the vector scores high on all three impact areas. The record shows low privileges are required. I found no statement that the CVE is exploited in the wild, and it is not marked as known exploited. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for checking the packages your own projects pull in.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
KoreLogic says v0.1.117, released 2024-04-03. Later releases include it.
Why was disclosure so late?
KoreLogic reported it in March 2024, the fix shipped in April, and public disclosure was 2024-08-07, per the advisory.
Sources
Last reviewed: 19 October 2026.
