PT-2026-30687 · Unknown · Text-Generation-Webui

Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35050

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions text-generation-webui versions prior to 4.1.1

Description text-generation-webui is an open-source web interface for running Large Language Models. Prior to version 4.1.1, users could save extension settings in '.py' format within the application root directory, enabling overwriting of Python files such as 'download-model.py'. This overwritten file could then be triggered for execution through the 'Model' menu when a new model download was requested.

Recommendations Update to version 4.1.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35050

Affected Products

Text-Generation-Webui

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-35050 · Security Note
• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jg96-p5p6-q3cv · Note
• https://twitter.com/0dayPublishing/status/2041212968323477902 · Twitter Post