Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

text-generation-webui — Vulnerabilities & Security Advisories 9

All 9 CVE vulnerabilities found in text-generation-webui, with AI-generated Chinese analysis, references, and POCs.

Vendor: oobabooga

CVE IDTitleCVSSSeverityPublished
CVE-2026-35487 text-generation-webui has a Path Traversal in load_prompt() — .txt file read without authentication CWE-22 5.3 Medium2026-04-07
CVE-2026-35486 text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation CWE-918 7.5 High2026-04-07
CVE-2026-35485 text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authentication CWE-22 7.5 High2026-04-07
CVE-2026-35484 text-generation-webui has a Path Traversal in load_preset() — .yaml file read without authentication CWE-22 5.3 Medium2026-04-07
CVE-2026-35483 text-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authentication CWE-22 5.3 Medium2026-04-07
CVE-2026-35050 text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml". CWE-22 9.1 Critical2026-04-06
CVE-2025-12487 oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability CWE-807 9.8 -2025-11-06
CVE-2025-12488 oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability CWE-807 9.8 -2025-11-06
CVE-2025-62364 text-generation-webui allows arbitrary file read via symbolic link upload CWE-59 6.2 Medium2025-10-13

All 9 known CVE vulnerabilities affecting text-generation-webui with full Chinese analysis, references, and POCs where available.