{"data":{"id":"1d96dce1-b8f7-4c1b-a9f7-0ae85be48aa3","title":"CVE-2025-67819: An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the…","summary":"CVE-2025-67819 affects Weaviate OSS before 1.33.4. Missing validation of the fileName field in the transfer logic lets an attacker who can call the GetFile method read arbitrary files accessible to the service process, but only while a shard is in the \"Pause file activity\" state and the FileReplicationService is reachable. The weakness is classified as CWE-22, Path Traversal.","solution":"Source references a Weaviate security release note (https://weaviate.io/blog/weaviate-security-release-november-2025) and the Weaviate GitHub repository, but the fixed version is stated only as \"before 1.33.4\" as the affected range and no explicit patch instruction is given in the text. Upgrade to 1.33.4 or later is implied by the affected range but is not stated as a fix in the source text.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-67819","publishedAt":"2025-12-12T22:15:45.697Z","cveId":"CVE-2025-67819","cweIds":["CWE-22"],"cvssScore":"4.9","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/weaviate/weaviate@>= 1.30.0, < 1.30.20 (fixed: 1.30.20)","github.com/weaviate/weaviate@>= 1.31.0-rc.0, < 1.31.19 (fixed: 1.31.19)","github.com/weaviate/weaviate@>= 1.32.0-rc.0, < 1.32.16 (fixed: 1.32.16)","github.com/weaviate/weaviate@>= 1.33.0-rc.0, < 1.33.4 (fixed: 1.33.4)"],"affectedPackageNames":["github.com/weaviate/weaviate"],"affectedPackageRefs":["go:github.com/weaviate/weaviate"],"affectedVendors":[],"affectedVendorsRaw":["Weaviate"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Weaviate OSS arbitrary file read through GetFile method","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00502,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-hmmh-292h-3364"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:41.369Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-10-31T16:43:49.000Z","daysToFix":-42,"fixCheckedAt":"2026-10-29T21:42:18.225Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/weaviate/weaviate","fixedVersion":"1.30.20","matchedVersion":"v1.30.20","fixReleasedAt":"2025-11-03T08:26:41.000Z","daysToFix":-39,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:18.074Z"},{"ecosystem":"go","name":"github.com/weaviate/weaviate","fixedVersion":"1.31.19","matchedVersion":"v1.31.19","fixReleasedAt":"2025-11-03T08:42:34.000Z","daysToFix":-39,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:18.074Z"},{"ecosystem":"go","name":"github.com/weaviate/weaviate","fixedVersion":"1.33.4","matchedVersion":"v1.33.4","fixReleasedAt":"2025-11-03T09:12:22.000Z","daysToFix":-39,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:18.074Z"},{"ecosystem":"go","name":"github.com/weaviate/weaviate","fixedVersion":"1.32.16","matchedVersion":"v1.32.16","fixReleasedAt":"2025-10-31T16:43:49.000Z","daysToFix":-42,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:42:18.074Z"}]}}