CVE-2025-67819: Path Traversal
An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67819?
CVE-2025-67819 is considered a high-severity vulnerability due to its potential to expose sensitive filesystem data.
How do I fix CVE-2025-67819?
To mitigate CVE-2025-67819, upgrade Weaviate to version 1.33.4 or later.
What is the impact of CVE-2025-67819?
The impact of CVE-2025-67819 allows an attacker to read arbitrary files if the FileReplicationService is accessible.
Who is affected by CVE-2025-67819?
CVE-2025-67819 affects Weaviate OSS versions prior to 1.33.4.
What is the nature of the vulnerability in CVE-2025-67819?
CVE-2025-67819 results from a lack of validation of the fileName field in the transfer logic during a specific state.