Description
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open WebUI | Open WebUI | 0.1.105 | — |
References
- https://korelogic.com/Resources/Advisories/KL-001-2024-006.txt third-party-advisory