PT-2026-30860 · Unknown · Text-Generation-Webui

Programsurf + 2 · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-35487

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions text-generation-webui versions prior to 4.3

Description text-generation-webui is an open-source web interface for running Large Language Models. A path traversal flaw exists in the load prompt() function, allowing unauthenticated users to read any .txt file on the server filesystem. The content of the file is directly returned in the API response.

Recommendations Update to version 4.3 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35487

Affected Products

Text-Generation-Webui

References · 4

• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-mfgg-vvc6-vqq7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35487 · Security Note
• https://twitter.com/VulmonFeeds/status/2041624688204435940 · Twitter Post
• https://twitter.com/CVEnew/status/2041603227276149004 · Twitter Post