CVE-2024-7034: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint

The vulnerability description explicitly identifies the pattern file_path = f"{UPLOAD_DIR}/{file.filename}" as the root cause. This code pattern would typically exist in the request handler function for the /models/upload endpoint. While exact function names and file paths aren't provided in the advisory, the described vulnerability pattern clearly indicates the file upload handling function associated with this endpoint is vulnerable due to: 1) Direct use of user-controlled filename without sanitization 2) Lack of path normalization 3) Absence of checks preventing directory traversal. The confidence is high because the code snippet provided in the advisory directly maps to common web framework file upload handler implementations.