Browser-Use web-ui versions 2.0.0 through 3.0.0 contain an input validation flaw in the run_agent_task endpoint that allows an attacker to provide absolute paths for the settings parameters. When an unauthenticated user supplies absolute directory names for save_recording_path, save_trace_path, save_agent_history_path, or save_download_path, the daemon silently creates those directories, permitting the creation of arbitrary directory trees under any location writable by the container process. This flaw can be leveraged to write files if the attacker can upload content, potentially leading to privilege escalation or persistence. The vulnerability is a manifestation of CWE‑73, path traversal.

Vendor: Browser‑Use, product: web‑ui. The affected version range is 2.0.0 to 3.0.0 inclusive; all releases within this span share the same unchecked path handling in the Gradio interface. The component is identified by the CPE cpe:2.3:a:browser‑use:browser_use.

CVSS assessment assigns a medium severity score of 6.9. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires access to the unauthenticated Gradio service, which may be reachable on a public or internal network. An attacker can invoke the endpoint, supply absolute paths, and cause the container process to create directories wherever it has write permission. If the container runs with root privileges, the ability to create directories in critical system paths could lead to system compromise or unauthorized data storage. The overall risk is significant for environments where the service is exposed without authentication.