PT-2026-30856 · Unknown · Text-Generation-Webui

Programsurf + 2 · CVE-2026-35483 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions text-generation-webui versions prior to 4.3

Description text-generation-webui is an open-source web interface for running Large Language Models. A path traversal flaw exists in the load template() function that allows an unauthenticated attacker to read files with the extensions .jinja, .jinja2, .yaml, or .yml from any location on the server's filesystem. For .jinja files, the content is returned directly. For .yaml files, a parsed key is extracted.

Recommendations Update to version 4.3 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35483

GHSA-85FX-VW25-4C95

Affected Products

Text-Generation-Webui

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35483.json · Exploit
• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-85fx-vw25-4c95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35483 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35483 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041603231286018303 · Twitter Post