CVE-2026-34524: fallo de gravedad alta en SillyTavern
SillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data root
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.6%
probabilidad de explotación
0.6%top 53% de las CVE
explotación observada
noninguna fuente lo reporta
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Productos afectados
SillyTavern · SillyTavernCVEs relacionadas — SillyTavern
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-46372HIGHSillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrlEPSS 0.9%CVE-2026-108545HIGHSillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body ParsingEPSS 0.6%CVE-2026-44650CRITICALSillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')EPSS 0.6%CVE-2026-34523MEDIUMSillyTavern: Path traversal allows file existence oracleEPSS 0.4%CVE-2026-34522HIGHSillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directoryEPSS 0.4%CVE-2026-44648HIGHSillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeoverEPSS 0.4%