Unauthenticated Path Traversal Vulnerability in Text Generation Web UI by Oobabooga
CVE-2026-35484

5.3MEDIUM

Key Information:

Vendor

Oobabooga

Status
Text-generation-webui
Vendor
CVE Published:
7 April 2026

What is CVE-2026-35484?

The Text Generation Web UI, an open-source interface for deploying Large Language Models, has a path traversal vulnerability that allows unauthenticated users to access sensitive YAML configuration files on the server. This flaw, prior to version 4.3, enables attackers to retrieve key-value pairs from these files, exposing sensitive information such as passwords, API keys, and connection strings. The vulnerability has been mitigated in version 4.3.

Affected Version(s)

text-generation-webui < 4.3

References

https://github.com/oobabooga/text-generation-webui/securi...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.