CVE-2026-35485

{
  "id": "CVE-2026-35485",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-07T15:17:45.677",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does not server-side validate dropdown values, so an attacker can POST directory traversal payloads (e.g., ../../../etc/passwd) via the API and receive the full file contents in the response. This vulnerability is fixed in 4.3."
    },
    {
      "lang": "es",
      "value": "text-generation-webui es una interfaz web de código abierto para ejecutar Modelos de Lenguaje Grandes. Antes de la versión 4.3, una vulnerabilidad de salto de ruta no autenticada en load_grammar() permite leer cualquier archivo en el sistema de archivos del servidor sin restricción de extensión. Gradio no valida los valores de los desplegables en el lado del servidor, por lo que un atacante puede enviar cargas útiles de salto de directorio (por ejemplo, .. / .. / .. / etc/p4ssd) a través de la API y recibir el contenido completo del archivo en la respuesta. Esta vulnerabilidad está corregida en la versión 4.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "oobabooga",
          "product": "text-generation-webui",
          "versions": [
            {
              "version": "< 4.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-07T15:11:37.214994Z",
          "id": "CVE-2026-35485",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oobabooga:textgen:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.3",
              "matchCriteriaId": "9A2B642B-80A8-46E1-931D-C5541264290A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-hqg5-487v-5mc6",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-hqg5-487v-5mc6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}