CVE-2025-62364
BaseFortify
Publication date: 2025-10-13
Last updated on: 2025-10-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oobabooga | text-generation-webui | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Local File Inclusion issue in text-generation-webui versions through 3.13. It occurs in the character picture upload feature, where an attacker can upload a text file containing a symbolic link to any file path. When the application processes this upload, it follows the symbolic link and serves the contents of the targeted file through the web interface, allowing an unauthenticated attacker to read sensitive files on the server.
How can this vulnerability impact me? :
The vulnerability allows an unauthenticated attacker to read sensitive files on the server, which can lead to exposure of system configurations, credentials, and other confidential information. This can compromise the security of the server and potentially lead to further attacks or data breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can negatively impact compliance with standards and regulations such as GDPR and HIPAA because it allows unauthorized access to sensitive and confidential information. Exposure of such data could lead to violations of data protection requirements and result in legal and regulatory consequences.
What immediate steps should I take to mitigate this vulnerability?
Upgrade text-generation-webui to version 3.14 or later, as this version contains the fix for the Local File Inclusion vulnerability. No known workarounds exist, so updating is the recommended immediate mitigation step.