CVE-2025-7647

Name of the Vulnerable Software and Affected Versions llama-index-core versions through 0.12.44

Description The software has an issue in the get cache dir() function due to the use of a predictable, hardcoded directory path /tmp/llama index on Linux systems without sufficient security measures. This could allow attackers on multi-user systems to steal proprietary models, compromise cached embeddings, or perform symlink attacks. The issue impacts all Linux deployments where multiple users share the same system. The vulnerability is related to insecure temporary file creation and potential race conditions.

Recommendations Versions prior to 0.12.44 should be updated.