Executive brief
browser-use web-ui is an unauthenticated web interface for running AI agents in a browser. Versions 2.0.0 through 3.0.0 fail to validate file paths supplied by users, allowing attackers to create directories at arbitrary locations on the filesystem. If the application runs as root (as is typical in containers), attackers can write to any location, potentially disrupting service operations or enabling further exploitation.
Technical details
The run_agent_task function in browser-use web-ui versions 2.0.0 through 3.0.0 accepts user-supplied paths via save_recording_path, save_trace_path, save_agent_history_path, and save_download_path parameters without validating or sanitizing them. An attacker can supply absolute paths to create directories at arbitrary filesystem locations. The vulnerability is reachable over the network through the unauthenticated Gradio web interface, requiring no authentication or user interaction. Exploitation allows an attacker to create directories in any location writable by the container process (typically root), which could be used to disrupt operations, inject files into sensitive locations, or facilitate further attacks. Patched versions after 3.0.0 should implement proper path validation.
Affected products
- browser-use web-ui 2.0.0 through 3.0.0
Timeline
- 2026-08-30: disclosed