CVE-2026-44650: fallo crítico en SillyTavern
SillyTavern: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Publicada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 0.6%
probabilidad de explotación
0.6%top 53% de las CVE
explotación observada
noninguna fuente lo reporta
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, POST /api/extensions/delete endpoint accepts extensionName: "." which bypasses sanitize-filename validation, causing the entire user extensions directory to be recursively deleted. No authentication is required in the default configuration. This vulnerability is fixed in 1.18.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Productos afectados
SillyTavern · SillyTavernCVEs relacionadas — SillyTavern
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-46372HIGHSillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrlEPSS 0.9%CVE-2026-108545HIGHSillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body ParsingEPSS 0.6%CVE-2026-34524HIGHSillyTavern: Path traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user data rootEPSS 0.6%CVE-2026-34523MEDIUMSillyTavern: Path traversal allows file existence oracleEPSS 0.4%CVE-2026-34522HIGHSillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directoryEPSS 0.4%CVE-2026-44648HIGHSillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeoverEPSS 0.4%