PT-2026-30860 · Oobabooga · Text-Generation-Webui

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-35487

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load prompt() allows reading any .txt file on the server filesystem. The file content is returned verbatim in the API response. This vulnerability is fixed in 4.3.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35487

Affected Products

Text-Generation-Webui

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-35487 · Security Note
• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-mfgg-vvc6-vqq7 · Note