Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-6209

A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary files on the server, including sensitive system files. The issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory. The vulnerability is fixed in version 0.12.41.

Published

2025-07-07T13:15:28.823

Last Modified

2025-07-30T20:01:32.410

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.0: 7.5 (HIGH)

Weaknesses

Type: Secondary
CWE-29

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	llamaindex	llamaindex	< 0.12.41	Yes

References

https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274 Patch ([email protected])
https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68 Exploit, Third Party Advisory ([email protected])
https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68 Exploit, Third Party Advisory (134c704f-9b21-4f2e-91b3-4a467353bcc0)