CVE-2026-35483: falha de média gravidade em oobabooga text-generation-webui
text-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authentication
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_template() allows reading files with .jinja, .jinja2, .yaml, or .yml extensions from anywhere on the server filesystem. For .jinja files the content is returned verbatim; for .yaml files a parsed key is extracted. This vulnerability is fixed in 4.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
oobabooga · text-generation-webuiCVEs relacionadas — oobabooga text-generation-webui
No mesmo produto, das mais perigosas para as menos.
CVE-2025-12487CRITICALoobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityEPSS 0.7%CVE-2025-12488CRITICALoobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityEPSS 0.7%CVE-2026-35485HIGHtext-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authenticationEPSS 0.7%CVE-2025-62364MEDIUMtext-generation-webui allows arbitrary file read via symbolic link uploadEPSS 0.6%CVE-2026-35050CRITICALtext-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".EPSS 0.4%CVE-2026-35486HIGHtext-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validationEPSS 0.4%