Unauthenticated Path Traversal in text-generation-webui by oobabooga
CVE-2026-35483

5.3MEDIUM

Key Information:

Vendor

Oobabooga

Status
Text-generation-webui
Vendor
CVE Published:
7 April 2026

What is CVE-2026-35483?

text-generation-webui, a web interface designed to facilitate the execution of Large Language Models, contains a vulnerability in its load_template() function that allows unauthenticated users to exploit a path traversal flaw. This issue permits access to sensitive files on the server, specifically those with .jinja, .jinja2, .yaml, or .yml extensions. The content of .jinja files is returned without modification, while .yaml files provide a parsed key. This vulnerability has been addressed in version 4.3, ensuring enhanced security against unauthorized file access.

Affected Version(s)

text-generation-webui < 4.3

References

https://github.com/oobabooga/text-generation-webui/securi...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.