Unauthenticated Path Traversal Vulnerability in Text Generation Web UI by Oobabooga
CVE-2026-35485

7.5HIGH

Key Information:

Vendor

Oobabooga

Status
Text-generation-webui
Vendor
CVE Published:
7 April 2026

What is CVE-2026-35485?

An unauthenticated path traversal vulnerability exists in the 'load_grammar()' function of the text-generation-webui, enabling attackers to exploit the API and access sensitive files on the server's filesystem without any file extension restrictions. By crafting malicious POST requests with directory traversal payloads, such as '../../../etc/passwd', an attacker can retrieve complete file contents, potentially compromising system security. This issue has been addressed in version 4.3, which mitigates the vulnerability by implementing necessary server-side validations.

Affected Version(s)

text-generation-webui < 4.3

References

https://github.com/oobabooga/text-generation-webui/securi...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.