CVE-2025-62364

text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the application processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations, credentials, and other confidential information. This vulnerability is fixed in 3.14. No known workarounds exist.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/oobabooga/text-generation-webui/commit/282aa1918907fceec7f903d3dc2bc8492ce8e885
https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-66rw-q8w5-c2hg

Configurations

No configuration.

History

08 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) text-generation-webui es una interfaz web de código abierto para ejecutar Modelos de Lenguaje Grandes. En versiones hasta la 3.13, existe una vulnerabilidad de inclusión local de ficheros en la función de carga de imágenes de personajes. Un atacante puede cargar un fichero de texto que contiene un enlace simbólico a una ruta de fichero arbitraria. Cuando la aplicación procesa la carga, sigue el enlace simbólico y sirve el contenido del fichero objetivo a través de la interfaz web. Esto permite a un atacante no autenticado leer ficheros sensibles en el servidor, exponiendo potencialmente configuraciones del sistema, credenciales y otra información confidencial. Esta vulnerabilidad está corregida en 3.14. No existen soluciones alternativas conocidas.

Information

Published : 2025-10-13 21:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-62364

Mitre link : CVE-2025-62364

CVE.ORG link : CVE-2025-62364

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2025-62364", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62364", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T15:08:52.957046Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "oobabooga", "product": "text-generation-webui", "versions": [{"status": "affected", "version": "<= 3.13"}]}]}], "published": "2025-10-13T21:15:35.560", "references": [{"url": "https://github.com/oobabooga/text-generation-webui/commit/282aa1918907fceec7f903d3dc2bc8492ce8e885", "source": "security-advisories@github.com"}, {"url": "https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-66rw-q8w5-c2hg", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the application processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations, credentials, and other confidential information. This vulnerability is fixed in 3.14. No known workarounds exist."}, {"lang": "es", "value": "text-generation-webui es una interfaz web de c\u00f3digo abierto para ejecutar Modelos de Lenguaje Grandes. En versiones hasta la 3.13, existe una vulnerabilidad de inclusi\u00f3n local de ficheros en la funci\u00f3n de carga de im\u00e1genes de personajes. Un atacante puede cargar un fichero de texto que contiene un enlace simb\u00f3lico a una ruta de fichero arbitraria. Cuando la aplicaci\u00f3n procesa la carga, sigue el enlace simb\u00f3lico y sirve el contenido del fichero objetivo a trav\u00e9s de la interfaz web. Esto permite a un atacante no autenticado leer ficheros sensibles en el servidor, exponiendo potencialmente configuraciones del sistema, credenciales y otra informaci\u00f3n confidencial. Esta vulnerabilidad est\u00e1 corregida en 3.14. No existen soluciones alternativas conocidas."}], "lastModified": "2026-10-08T12:10:00.217", "sourceIdentifier": "security-advisories@github.com"}