PT-2025-28148 · Unknown · Llama Index

Published 2025-07-07 · Updated 2025-07-30 · CVE-2025-3044

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: llama index versions up to v0.12.22.post1

Description: A vulnerability in the ArxivReader class allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training.

Recommendations: For versions up to v0.12.22.post1, update to version 0.12.28 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-440

Related Identifiers

BDU:2025-09018

CVE-2025-3044

GHSA-P7J4-JWJF-5X9W

Affected Products

Llama Index

References · 11

• 🔥 https://huntr.com/bounties/80182c3a-876f-422f-8bac-38267e0345d6 · Exploit
• https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e · Patch
• https://bdu.fstec.ru/vul/2025-09018 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3044 · Security Note
• https://osv.dev/vulnerability/GHSA-p7j4-jwjf-5x9w · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://github.com/run-llama/llama_index/commit/f69e1c0e7579228fec4cfaf716e4f951e131de77 · Note
• https://t.me/cveNotify/130331 · Telegram Post
• https://twitter.com/CVEnew/status/1942166387318755421 · Twitter Post
• https://t.me/cvenotify/127814 · Telegram Post