Vulnerability in Oobabooga Text-Generation-Webui
CVE-2025-62364
text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the application processes the upload, it follows the symbolic link and serves the contents of the targeted file through the web interface. This allows an unauthenticated attacker to read sensitive files on the server, potentially exposing system configurations, credentials, and other confidential information. This vulnerability is fixed in 3.14. No known workarounds exist.
EPSS: 0.005 (41.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Oobabooga Text-generation-webui — versions <= 3.13
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-62364?
- CVE-2025-62364 is a medium-severity vulnerability in Oobabooga Text-Generation-Webui, classified under Improper Link Resolution Before File Access. CVSS score: 6.2/10. Published 2025-10-13.
- How severe is CVE-2025-62364?
- Medium severity. CVSS v3 base score is 6.2 out of 10.
- Is CVE-2025-62364 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.