https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:29:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-280213 EUVD-2026-280213 https://cve.radiocsirt.org/vuln/euvd-2026-280213 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34524 <p>SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url=&#34;..&#34;. This issue has been patched in version 1.17.0.</p> <p>SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url=&#34;..&#34;. This issue has been patched in version 1.17.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34524 https://cve.radiocsirt.org/vuln/ghsa-vprr-q85p-79mf <p><strong>Affected:</strong> npm: sillytavern</p> <p>## Summary A Path Traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example `secrets.json` and `settings.json`) by supplying `avatar_url=&#34;..&#34;`.</p> <p>### Details The input validator used by `avatar_url` blocks only `/` and NUL bytes, but does not block traversal segments like `..`.</p> <p>Evidence: - Weak validator regex (does not reject `..`): &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/middleware/validateFileName.js#L24-L27&gt; - Vulnerable delete path construction: &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L575-L577&gt; - Vulnerable export path construction: &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L595-L598&gt; - Endpoint auth context (authenticated user access): &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239&gt;</p> <p>Because `avatar_url=&#34;..&#34;` is accepted, `path.join(&lt;user&gt;/chats, &#34;..&#34;)` resolves to `&lt;user&gt;/`, enabling direct access to files outside the chats directory.</p> <p>### PoC Prerequisites: - Valid authenticated session cookie (`cookie.txt`) - Valid CSRF token (`$TOKEN`)</p> <p>Read sensitive file (`secrets.json`):</p> <p>```bash curl -b cookie.txt -H &#34;x-csrf-token: $TOKEN&#34; -H &#34;content-type: application/json&#34; \ -d &#39;{&#34;avatar_url&#34;:&#34;..&#34;,&#34;is_group…</p> <p><strong>Affected:</strong> npm: sillytavern</p> <p>## Summary A Path Traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example `secrets.json` and `settings.json`) by supplying `avatar_url=&#34;..&#34;`.</p> <p>### Details The input validator used by `avatar_url` blocks only `/` and NUL bytes, but does not block traversal segments like `..`.</p> <p>Evidence: - Weak validator regex (does not reject `..`): &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/middleware/validateFileName.js#L24-L27&gt; - Vulnerable delete path construction: &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L575-L577&gt; - Vulnerable export path construction: &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L595-L598&gt; - Endpoint auth context (authenticated user access): &lt;https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239&gt;</p> <p>Because `avatar_url=&#34;..&#34;` is accepted, `path.join(&lt;user&gt;/chats, &#34;..&#34;)` resolves to `&lt;user&gt;/`, enabling direct access to files outside the chats directory.</p> <p>### PoC Prerequisites: - Valid authenticated session cookie (`cookie.txt`) - Valid CSRF token (`$TOKEN`)</p> <p>Read sensitive file (`secrets.json`):</p> <p>```bash curl -b cookie.txt -H &#34;x-csrf-token: $TOKEN&#34; -H &#34;content-type: application/json&#34; \ -d &#39;{&#34;avatar_url&#34;:&#34;..&#34;,&#34;is_group…</p> https://cve.radiocsirt.org/vuln/ghsa-vprr-q85p-79mf