CVE-2026-35050: fallo crítico en oobabooga text-generation-webui
text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.4%
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py" file could be overwritten. Then, this python file can be triggered to get executed from "Model" menu when requesting to download a new model. This vulnerability is fixed in 4.1.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Productos afectados
oobabooga · text-generation-webuiCVEs relacionadas — oobabooga text-generation-webui
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-12487CRITICALoobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-12488CRITICALoobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-35485HIGHtext-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authenticationEPSS 0.7%CVE-2025-62364MEDIUMtext-generation-webui allows arbitrary file read via symbolic link uploadEPSS 0.6%CVE-2026-35486HIGHtext-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validationEPSS 0.4%CVE-2026-35483MEDIUMtext-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authenticationEPSS 0.3%