CVE-2026-34523

Summary: The CVE is connected to a path traversal vulnerability in SillyTavern. The static file route handler uses a directory function and a user-supplied, percent-encoded path without proper boundary checks, allowing an unauthenticated user to determine whether files exist on the server. The ex...

CVE-2026-34523 SillyTavern: Path traversal allows file existence oracle

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in the static file route handler allows any unauthenticate...

Vociferous 访问控制错误漏洞

Vociferous is a cross-platform offline voice-to-text tool developed by Andrew Brown. Versions prior to 4.4.2 of Vociferous contained an access control vulnerability. This vulnerability stemmed from the lack of filename validation in the exportfile route in src/api/system.py, along with unvalidate...

EUVD-2025-175818

Malicious code in unix-execute-file-route-reject npm...

PYSEC-2023-249

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...

Gradio makes the `/file` secure against file traversal and server-side request forgery attacks

Older versions of gradio contained a vulnerability in the /file route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL e.g. if the demo was created with share=True, or on Hugging Face Spaces...

PT-2023-31833 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio versions prior to 4.11.0 Description: The issue concerns a vulnerability in the /file route of Gradio, making it susceptible to file traversal attacks. An attacker could access arbitrary files on a machine running a Gradio app with a...