CVE-2025-62364

text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the application processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations, credentials, and other confidential information. This vulnerability is fixed in 3.14. No known workarounds exist.

• CWE-59

• https://github.com/oobabooga/text-generation-webui/commit/282aa1918907fceec7f903d3dc2bc8492ce8e885
• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-66rw-q8w5-c2hg

Published

Oct 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62359WeGIA is an open source Web Manager for Institutions with a …6.1
• CVE-2025-6236The Hostel WordPress plugin before 1.1.5.9 does not sanitise…4.8
• CVE-2025-62360WeGIA is an open source Web Manager for Institutions with a …8.8
• CVE-2025-62361WeGIA is an open source Web Manager for Institutions with a …6.1
• CVE-2025-62362gpp-burgerportaal is a Dutch government citizen portal appli…6.9
• CVE-2025-62363yt-grabber-tui is a terminal user interface application for …7.8
• CVE-2025-62365LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…6.1
• CVE-2025-62366mailgen is a Node.js package that generates responsive HTML …2.9
• CVE-2025-62367Taiga is an open source project management platform. In vers…4.8
• CVE-2025-62368Taiga is an open source project management platform. In vers…9
• CVE-2025-62369Xibo is an open source digital signage platform with a web c…7.2
• CVE-2025-6237A vulnerability in invokeai version v6.0.0a1 and below allow…9.8