CVE-2026-82637: browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-30 · updated 2026-09-02
Weakness: CWE-73

Description

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

Affected products

browser-use web-ui: from 2.0.0 through 3.0.0

References

https://github.com/browser-use/web-ui
https://github.com/browser-use/web-ui/blob/v3.0.0/src/webui/components/browser_use_agent_tab.py
https://github.com/browser-use/web-ui/issues/737
https://www.vulncheck.com/advisories/browser-use-web-ui-2.0.0-through-3.0.0-arbitrary-directory-creation
https://github.com/browser-use/web-ui/issues/737

Get alerted when CVE-2026-82637 or the next vulnerability affects your stack