Insecure Temporary File Creation in Llama Index Core Package by Run Llama

CVE-2025-7647

What is CVE-2025-7647?

The llama-index-core package suffers from a vulnerability in the get_cache_dir() function, which relies on a hardcoded directory path (/tmp/llama_index) on Linux systems without adequate security measures. This flaw permits attackers on multi-user systems to access sensitive proprietary models, compromise cached embeddings, or initiate symlink attacks. All Linux deployments that support multi-user environments are susceptible, classifying this issue under multiple CWEs that emphasize insecure temporary file management and possible race conditions.

References