https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T14:13:09.730290+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-82637 CVE-2026-82637 — browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation 2026-10-06T14:13:09.748839+00:00

Affected: browser-use web-ui

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.