CVE-2026-82637

Katalog CVE

CVSS 5.3 · Medium EPSS 0,41%

Kerentanan External Control of File Name or Path. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

Rincian

Terbit di NVD

30 Agustus 2026

Terakhir diubah

2 September 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/browser-use/web-ui
• https://github.com/browser-use/web-ui/blob/v3.0.0/src/webui/components/browser_use_agent_tab.py
• https://github.com/browser-use/web-ui/issues/737
• https://www.vulncheck.com/advisories/browser-use-web-ui-2.0.0-through-3.0.0-arbitrary-directory-creation