PT-2025-28163 · Unknown · Llama Index
Astrabert
·
Published
2025-07-07
·
Updated
2025-07-14
·
CVE-2025-6209
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
run-llama/llama index versions 0.12.27 through 0.12.40
Description:
A path traversal vulnerability exists, specifically within the
encode image function in generic utils.py, allowing an attacker to manipulate the image path input to read arbitrary files on the server, including sensitive system files. This issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory.Recommendations:
For run-llama/llama index versions 0.12.27 through 0.12.40, update to version 0.12.41 to resolve the issue. As a temporary workaround, consider restricting access to the
encode image function in generic utils.py to minimize the risk of exploitation. Avoid using the image path input in the affected function until the issue is resolved.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Llama Index