Directory Deletion Flaw in SillyTavern User Interface

CVE-2026-44650

What is CVE-2026-44650?

The SillyTavern user interface, designed for interacting with various generative models, is susceptible to a security oversight that allows attackers to manipulate the POST /api/extensions/delete endpoint. By using a specific parameter value (extensionName: '.'), an authenticated user can bypass the sanitize-filename validation controls. This flaw results in the complete and recursive deletion of the user extensions directory. Moreover, the vulnerability is particularly dangerous as it does not require authentication to exploit in default configurations. The issue has been addressed in the SillyTavern version 1.18.0.

References