CVE-2025-62364

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-13

Last updated on: 2025-10-14

Assigner: GitHub, Inc.

Description

text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the application processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations, credentials, and other confidential information. This vulnerability is fixed in 3.14. No known workarounds exist.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-13

Last Modified

2025-10-14

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62364

Affected Vendors & Products

Vendor	Product	Version / Range
oobabooga	text-generation-webui	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a Local File Inclusion issue in text-generation-webui versions through 3.13. It occurs in the character picture upload feature, where an attacker can upload a text file containing a symbolic link to any file path. When the application processes this upload, it follows the symbolic link and serves the contents of the targeted file through the web interface, allowing an unauthenticated attacker to read sensitive files on the server.

Impact Analysis

The vulnerability allows an unauthenticated attacker to read sensitive files on the server, which can lead to exposure of system configurations, credentials, and other confidential information. This can compromise the security of the server and potentially lead to further attacks or data breaches.

Compliance Impact

This vulnerability can negatively impact compliance with standards and regulations such as GDPR and HIPAA because it allows unauthorized access to sensitive and confidential information. Exposure of such data could lead to violations of data protection requirements and result in legal and regulatory consequences.

Mitigation Strategies

Upgrade text-generation-webui to version 3.14 or later, as this version contains the fix for the Local File Inclusion vulnerability. No known workarounds exist, so updating is the recommended immediate mitigation step.

Hi! I’m here to help you understand CVE-2025-62364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70