CVE-2025-67819

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-12

Last updated on: 2025-12-19

Assigner: MITRE

Description

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-12

Last Modified

2025-12-19

Generated

2026-07-06

AI Q&A

2025-12-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67819

Affected Vendors & Products

Vendor	Product	Version / Range
weaviate	weaviate	From 1.30.0 (inc) to 1.30.19 (inc)
weaviate	weaviate	From 1.31.0 (inc) to 1.31.18 (inc)
weaviate	weaviate	From 1.32.0 (inc) to 1.32.15 (inc)
weaviate	weaviate	From 1.33.0 (inc) to 1.33.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Detection Guidance

Detection involves checking if the Shard Movement API is enabled and if shards are in the "Pause file activity" state, as exploitation requires these conditions. Since the API is disabled by default, verify the "REPLICA_MOVEMENT_ENABLED" flag status in your configuration. Additionally, monitor calls to the GetFile method with suspicious fileName parameters containing directory traversal sequences (e.g., ".." or absolute paths). Specific commands are not provided in the resources. [1]

Mitigation Strategies

Immediate mitigation steps include updating Weaviate to the fixed versions (1.33.4 or later) that address this vulnerability. Alternatively, disable the Shard Movement API by setting the "REPLICA_MOVEMENT_ENABLED" flag to false in your configuration. These actions will prevent exploitation of the path traversal vulnerability in the GetFile method. [1]

Executive Summary

This vulnerability exists in Weaviate OSS versions before 1.33.4. It is caused by a lack of validation of the fileName field in the transfer logic. An attacker who can invoke the GetFile method while a shard is in the 'Pause file activity' state and the FileReplicationService is reachable can exploit this to read arbitrary files accessible to the service process.

Impact Analysis

The vulnerability allows an attacker to read arbitrary files accessible to the service process, which could lead to unauthorized disclosure of sensitive information or data leakage.

Hi! I’m here to help you understand CVE-2025-67819. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70