PT-2025-27525 · Unknown · Llama Index

Astrabert · Published 2025-07-01 · Updated 2025-07-14 · CVE-2025-6210

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: llama index version 0.12.27

Description: A flaw in the ObsidianReader class allows for hardlink-based path traversal, enabling attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. This issue arises from inadequate handling of hardlinks in the load data() method.

Recommendations: For version 0.12.27, update to version 0.5.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive system files to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-6210

GHSA-3J8R-JF9W-5CMH

Affected Products

Llama Index

References · 10

• 🔥 https://huntr.com/bounties/a654b322-a509-4448-a1f5-0f22850b4687 · Exploit
• https://github.com/run-llama/llama_index/commit/a86c96ae0e662492eeb471b658ae849a93f628ff · Patch
• https://osv.dev/vulnerability/CVE-2025-6210 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3j8r-jf9w-5cmh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6210 · Security Note
• https://github.com/run-llama/llama_index · Note
• https://twitter.com/0xManan/status/1939971252296298627 · Twitter Post
• https://twitter.com/0xManan/status/1944681121117257791 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1942196987660583359 · Twitter Post
• https://twitter.com/CVEnew/status/1942166380406579525 · Twitter Post