CVE-2025-6209

A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary files on the server, including sensitive system files. The issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory. The vulnerability is fixed in version 0.12.41.

• CWE-29

• https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274Patch
• https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68Exploit, Third Party Advisory
• https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68Exploit, Third Party Advisory

Published

Jul 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62084Cross-Site Request Forgery (CSRF) vulnerability in Imdad Nex…4.3
• CVE-2025-62085Missing Authorization vulnerability in Bertha AI – Andrew Pa…5.3
• CVE-2025-62086Missing Authorization vulnerability in akazanstev Яндекс Дос…5.4
• CVE-2025-62087Missing Authorization vulnerability in Web Builder 143 Stick…4.3
• CVE-2025-62088Server-Side Request Forgery (SSRF) vulnerability in extendon…5.4
• CVE-2025-62089Cross-Site Request Forgery (CSRF) vulnerability in MERGADO M…4.3
• CVE-2025-62090Missing Authorization vulnerability in Jegstudio Gutenverse …6.5
• CVE-2025-62091Missing Authorization vulnerability in Vollstart Serial Code…5.4
• CVE-2025-62092Missing Authorization vulnerability in Wiremo Wiremo woo-rev…5.3
• CVE-2025-62093Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2025-62094Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-62095Improper Neutralization of Input During Web Page Generation …6.5