Local File Inclusion Vulnerability in text-generation-webui by Oobabooga

CVE-2025-62364

What is CVE-2025-62364?

A Local File Inclusion vulnerability has been identified in the text-generation-webui, an open-source web interface developed by Oobabooga for running Large Language Models. This vulnerability affects versions up to 3.13 and allows an attacker to exploit the character picture upload feature to upload a malicious text file. The file can contain a symbolic link pointing to an arbitrary file path. Once the upload is processed by the application, the symbolic link is followed, resulting in the unintended exposure of sensitive files. This can potentially reveal critical system files, configurations, and credential information to an unauthenticated attacker. The issue has been rectified in version 3.14, and no workarounds exist.

References