PT-2025-50957 · Unknown · Weaviate Oss
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Weaviate OSS versions prior to 1.33.4
Description
An attacker who can insert data into the database can create an entry name containing an absolute path (for example, /etc/...) or utilize parent directory traversal (../../..) to bypass the restore root during a backup restoration. This could lead to the creation or overwriting of files in arbitrary locations within the application's permissions.
Recommendations
Update to version 1.33.4 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Weaviate Oss