Description

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-30T14:17:03.470Z",
  "pubdate": "2026-08-30T14:17:03.470Z",
  "executiveSummary": "The browser-use web-ui application, specifically versions 2.0.0 through 3.0.0, contains an improper input validation vulnerability within the run_agent_task function.\nThis security flaw enables an unauthenticated attacker to manipulate file path parameters to force the application to create directories at arbitrary locations on the host file system.\nThe vulnerability arises because the application fails to sanitize or constrain file path inputs, such as save_recording_path, save_trace_path, save_agent_history_path, and save_download_path, against absolute path injection.\nGiven that the application frequently operates within a containerized environment with elevated privileges, this flaw allows for unauthorized file system modifications.\nThe impact includes potential interference with system configuration, file system exhaustion, or the preparation of malicious payloads for subsequent exploitation vectors.\nThe attack vector is remotely exploitable via the exposed Gradio interface without requiring prior authentication or user interaction.",
  "technicalDetails": "The vulnerability exists within the run_agent_task function of the browser-use web-ui, which handles configuration parameters for agent execution logs and artifacts. The root cause is a lack of path sanitization during the processing of user-supplied strings for file system locations.\nThe application accepts several parameters that dictate where internal data should be persisted: save_recording_path, save_trace_path, save_agent_history_path, and save_download_path. In affected versions 2.0.0 through 3.0.0, these inputs are not validated to ensure they reside within a designated, restricted root directory or sandboxed environment.\nAn attacker can exploit this by passing an absolute path (e.g., /etc/ or /root/) instead of a relative file path through the Gradio web interface. When the backend processes these parameters, it executes file system operations that attempt to initialize or write to the provided path. Because the application logic does not restrict the scope of these paths, the operating system honors the request, resulting in the creation of directories at the specified absolute location provided the process has sufficient permissions.\nThe exploit flow begins with the attacker accessing the unauthenticated Gradio web interface. The attacker then submits a specifically crafted task request where one of the aforementioned path parameters is set to a malicious absolute path. Upon submission, the backend triggers the run_agent_task logic, which invokes directory creation routines using the unsanitized attacker-controlled input. This results in the creation of directories wherever the containerized process possesses write access.\nThe impact of this vulnerability is significant, particularly in containerized deployments where the service might be running as root. By creating directories at arbitrary locations, an attacker can disrupt services by creating directory structures in restricted locations or overwrite existing file structures if write permissions allow. Furthermore, this provides a primitive that can be leveraged in more complex exploit chains, such as facilitating file write operations by creating destination directories that an attacker might later use to drop malicious files via other vulnerabilities or misconfigurations.\nThe lack of authentication on the Gradio interface ensures that this attack can be performed by any external actor capable of reaching the web UI, increasing the surface area for unauthorized manipulation of the host or container environment."
}