PT-2026-30687 · Unknown · Text-Generation-Webui

Oobabooga · CVE-2026-35050 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions text-generation-webui versions prior to 4.1.1

Description text-generation-webui is an open-source web interface for running Large Language Models. Prior to version 4.1.1, users could save extension settings in '.py' format within the application root directory, enabling overwriting of Python files such as 'download-model.py'. This overwritten file could then be triggered for execution through the 'Model' menu when a new model download was requested.

Recommendations Update to version 4.1.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35050

GHSA-JG96-P5P6-Q3CV

Affected Products

Text-Generation-Webui

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35050.json · Exploit
• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jg96-p5p6-q3cv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-35050 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35050 · Security Note
• https://twitter.com/CVEnew/status/2041223954749092234 · Twitter Post
• https://twitter.com/0dayPublishing/status/2041212968323477902 · Twitter Post
• https://twitter.com/CveFindCom/status/2041225150218064239 · Twitter Post