PT-2025-39733 · Unknown · Llama-Index-Core

Published 2025-06-29 · Updated 2025-10-01 · CVE-2025-7647

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions llama-index-core versions through 0.12.44

Description The software has an issue in the get cache dir() function due to the use of a predictable, hardcoded directory path /tmp/llama index on Linux systems without sufficient security measures. This could allow attackers on multi-user systems to steal proprietary models, compromise cached embeddings, or perform symlink attacks. The issue impacts all Linux deployments where multiple users share the same system. The vulnerability is related to insecure temporary file creation and potential race conditions.

Recommendations Versions prior to 0.12.44 should be updated.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-377

CWE-367

CWE-378

CWE-379

Related Identifiers

BDU:2025-13308

CVE-2025-7647

GHSA-CR7Q-2W66-HJCM

Affected Products

Llama-Index-Core

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-7647 · Security Note
• https://osv.dev/vulnerability/GHSA-cr7q-2w66-hjcm · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13308 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7647 · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4 · Note
• https://twitter.com/CheckmarxZero/status/1973378117029814595 · Twitter Post
• https://t.me/CVEtracker/33548 · Telegram Post
• https://t.me/cveNotify/136707 · Telegram Post
• https://huntr.com/bounties/a2baa08f-98bf-47a8-ac83-06f7411afd9e · Note
• https://twitter.com/CVEnew/status/1971980769531682894 · Twitter Post