CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/weaviate/weaviate	Product
https://weaviate.io/blog/weaviate-security-release-november-2025	Release Notes

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:weaviate:weaviate::::::::
	cpe:2.3:a:weaviate:weaviate::::::::
	cpe:2.3:a:weaviate:weaviate::::::::
	cpe:2.3:a:weaviate:weaviate::::::::

History

14 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en Weaviate OSS anterior a la versión 1.33.4. Debido a una falta de validación del campo fileName en la lógica de transferencia, un atacante que puede llamar al método GetFile mientras un fragmento está en el estado 'Pausar actividad de archivo' y el FileReplicationService es accesible puede leer archivos arbitrarios accesibles al proceso del servicio.

Information

Published : 2025-12-12 17:15

Updated : 2026-10-14 17:10

NVD link : CVE-2025-67819

Mitre link : CVE-2025-67819

CVE.ORG link : CVE-2025-67819

JSON object : View

Products Affected

weaviate

weaviate

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-67819", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67819", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T19:14:28.378709Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-12T17:15:45.697", "references": [{"url": "https://github.com/weaviate/weaviate", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://weaviate.io/blog/weaviate-security-release-november-2025", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the \"Pause file activity\" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Weaviate OSS anterior a la versi\u00f3n 1.33.4. Debido a una falta de validaci\u00f3n del campo fileName en la l\u00f3gica de transferencia, un atacante que puede llamar al m\u00e9todo GetFile mientras un fragmento est\u00e1 en el estado 'Pausar actividad de archivo' y el FileReplicationService es accesible puede leer archivos arbitrarios accesibles al proceso del servicio."}], "lastModified": "2026-10-14T17:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB306075-3057-4BB2-AE5B-2C921334F225", "versionEndIncluding": "1.30.19", "versionStartIncluding": "1.30.0"}, {"criteria": "cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC712431-DA4B-453B-8F98-5105AAB29254", "versionEndIncluding": "1.31.18", "versionStartIncluding": "1.31.0"}, {"criteria": "cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "469882C7-C780-4374-8C38-60F39ADF012A", "versionEndIncluding": "1.32.15", "versionStartIncluding": "1.32.0"}, {"criteria": "cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14DB7679-8ED5-4315-8D6E-82895E5DB466", "versionEndIncluding": "1.33.3", "versionStartIncluding": "1.33.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}