Arbitrary File Write Vulnerability in txtai Framework by Neuml

CVE-2025-10854

What is CVE-2025-10854?

The txtai framework, known for its efficient handling of embedding indices, suffers from a vulnerability that allows arbitrary file writing. Although the validate function aims to protect against path traversal vulnerabilities by checking for safe filenames, it fails to adequately address symbolic links within compressed tar files. This oversight can be exploited by an attacker to write files to any location in the filesystem when untrusted embedding indices are loaded. Users of txtai are advised to review the associated security implications and apply necessary patches.

References