{"data":{"id":"46aa2528-edc3-4fb2-a009-95be1c9b286c","title":"CVE-2025-62364: text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a…","summary":"CVE-2025-62364 is a Local File Inclusion flaw in text-generation-webui versions through 3.13, in the character picture upload feature. An attacker uploads a text file containing a symbolic link to an arbitrary path, and the application follows it and serves the targeted file's contents through the web interface. The attack requires no authentication, exposing system configurations, credentials and other confidential files on the server.","solution":"Fixed in 3.14. No known workarounds exist.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62364","publishedAt":"2025-10-14T01:15:35.560Z","cveId":"CVE-2025-62364","cweIds":["CWE-59"],"cvssScore":"6.2","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["text-generation-webui"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"text-generation-webui local file inclusion through character picture upload","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0057,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T12:08:37.021Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"inference","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}