CVE-2026-82637 in web-ui
Summary
by MITRE • 08/30/2026
browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified in browser-use web-ui versions 2.0.0 through 3.0.0 represents a critical path traversal and arbitrary directory creation flaw within the application's agent task execution logic. This security defect stems from an insufficient validation of user-supplied input specifically targeting file system paths used for recording, tracing, history saving, and download management. The core technical failure occurs in the run_agent_task function, which accepts parameters such as save_recording_path, save_trace_path, save_agent_history_path, and save_download_path without enforcing strict constraints on their format or location. By accepting absolute paths rather than restricting inputs to relative directories within a designated safe root, the application allows attackers to dictate exactly where new filesystem entries are created. This lack of input sanitization means that any path component provided by the user is passed directly to the underlying operating system's directory creation routines without verification against an allowlist or chroot environment.
The operational impact of this vulnerability is significant due to its interaction with the deployment context, particularly when running in containerized environments like Docker. The browser-use web-ui exposes a Gradio interface that serves as the primary point of entry for user interactions. Crucially, this interface is unauthenticated by default or can be accessed without proper credentials depending on configuration settings. This lack of authentication allows any network-accessible actor to interact with the vulnerable endpoints. When an attacker supplies absolute paths such as /etc or other sensitive system directories via these parameters, the application attempts to create those directories if they do not already exist. If the container is running with elevated privileges or root access, which is common in development and testing environments but also occurs in production misconfigurations, this action succeeds without restriction. The ability to create arbitrary directories can serve as a foothold for further attacks, including privilege escalation, data exfiltration by creating staging areas for malicious files, or denial of service through filesystem exhaustion if the attacker creates numerous nested directories rapidly.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-78 OS Command Injection in contexts where path manipulation leads to unintended system state changes. It also relates to CWE-94 Improper Control of Generation of Code or Script involving the misuse of input parameters that influence application behavior beyond intended boundaries. In terms of the MITRE ATT&CK framework, this exploit technique falls under T1083 File and Directory Discovery combined with T1567 Evade Anti-Bypassing Techniques if used to establish persistence or lateral movement vectors by creating hidden directories for malware staging. The unauthenticated nature of the Gradio interface further exacerbates the risk, as it removes a critical layer of defense that would otherwise limit exposure to trusted users only.
Mitigation strategies must address both the immediate code flaw and broader architectural security postures. Developers should immediately update browser-use web-ui to version 3.0.1 or later where this validation issue has been resolved by implementing strict path normalization and allowlisting mechanisms. For systems that cannot be updated instantly, administrators should enforce network-level controls such as firewall rules to restrict access to the Gradio interface exclusively from trusted internal IP ranges. Additionally, running the container with non-root privileges is essential to limit the blast radius of any successful exploitation attempt. Implementing a read-only root filesystem where possible and using volume mounts for specific writable directories can also prevent arbitrary directory creation outside expected boundaries. Regular security audits focusing on input validation in file system operations are recommended to detect similar flaws across other components of the application stack.