PT-2025-41812 · Unknown · Text-Generation-Webui

J1W0N-1209 + 2 · Published 2025-10-13 · Updated 2025-10-13 · CVE-2025-62364

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions text-generation-webui versions through 3.13

Description text-generation-webui is a web interface for running Large Language Models. A Local File Inclusion issue exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. The application follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations and credentials.

Recommendations Update to version 3.14 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-62364

GHSA-66RW-Q8W5-C2HG

Affected Products

Text-Generation-Webui

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62364.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62364 · Security Note
• https://github.com/oobabooga/text-generation-webui/commit/282aa1918907fceec7f903d3dc2bc8492ce8e885 · Note
• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-66rw-q8w5-c2hg · Note
• https://twitter.com/CVEnew/status/1977839365834371296 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1977849246377238784 · Twitter Post
• https://t.me/CVEtracker/34790 · Telegram Post