PT-2025-28163 · Unknown · Llama Index
Astrabert
·
Publicado
2025-07-07
·
Atualizado
2025-07-14
·
CVE-2025-6209
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
run-llama/llama index versions 0.12.27 through 0.12.40
Description:
A path traversal vulnerability exists, specifically within the
encode image function in generic utils.py, allowing an attacker to manipulate the image path input to read arbitrary files on the server, including sensitive system files. This issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory.Recommendations:
For run-llama/llama index versions 0.12.27 through 0.12.40, update to version 0.12.41 to resolve the issue. As a temporary workaround, consider restricting access to the
encode image function in generic utils.py to minimize the risk of exploitation. Avoid using the image path input in the affected function until the issue is resolved.Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Llama Index