CVE-2025-67819: Weaviate OSS arbitrary file read through GetFile method

Summary

CVE-2025-67819 affects Weaviate OSS before 1.33.4. Missing validation of the fileName field in the transfer logic lets an attacker who can call the GetFile method read arbitrary files accessible to the service process, but only while a shard is in the "Pause file activity" state and the FileReplicationService is reachable. The weakness is classified as CWE-22, Path Traversal.

Mitigation

Source references a Weaviate security release note (https://weaviate.io/blog/weaviate-security-release-november-2025) and the Weaviate GitHub repository, but the fixed version is stated only as "before 1.33.4" as the affected range and no explicit patch instruction is given in the text. Upgrade to 1.33.4 or later is implied by the affected range but is not stated as a fix in the source text.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• github.com/weaviate/weaviateGoNo LLM dependency detected · 4 tracked dependents

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online