Loading story…
Two high-severity path traversal vulnerabilities in SillyTavern allow authenticated attackers to access files outside intended chat directories in versions prior to 1.17.0. CVE-2026-34522 affects the /api/chats/import endpoint and lets an attacker write arbitrary files by injecting traversal sequences into the character_name parameter, creating a risk of unauthorized file modification and service disruption. The flaw carries a CVSS v3.1 rating of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
A second flaw, CVE-2026-34524, affects /api/chats/export and /api/chats/delete, where supplying avatar_url=".." can enable arbitrary file read and delete operations within the application's user data root. The issue could expose or destroy sensitive files including secrets.json and settings.json, with a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. Both vulnerabilities are classified as CWE-22 path traversal issues and were patched in SillyTavern 1.17.0.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Two CVEs were published for SillyTavern versions prior to 1.17.0: CVE-2026-34522 covering arbitrary file write via /api/chats/import, and CVE-2026-34524 covering arbitrary file read/delete via /api/chats/export and /api/chats/delete. The disclosures noted potential exposure or destruction of sensitive files such as secrets.json and settings.json.
The path traversal vulnerability in SillyTavern's /api/chats/import endpoint was received by security-advisories@github.com. The flaw allowed an authenticated attacker to write attacker-controlled files outside the intended chat directory via the character_name parameter.
SillyTavern released version 1.17.0 to patch multiple authenticated path traversal vulnerabilities affecting chat import, export, and delete endpoints. The fixes addressed arbitrary file write outside the chats directory and arbitrary file read/delete within the user data root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenBMB ChatDev through version **2.2.0** is affected by **`CVE-2026-58166`**, a critical unauthenticated path traversal flaw in its file upload handler that lets remote attackers write or delete arbitrary files on the server. The vulnerability stems from the `POST` uploads session endpoint, where a malicious multipart filename containing traversal sequences or an absolute path is passed into `save_upload_file` without proper sanitization, allowing attacker-controlled filesystem paths to be used during upload and cleanup operations. The issue is rated **CVSS 3.1 9.1 (Critical)**, with a listed **CVSS 4.0 8.8 (High)**, and is considered remotely exploitable without authentication. The flaw was fixed in commit **`4fd4da6`**, and affected organizations should update to a patched release and enforce strict validation and sanitization of upload filenames and paths to prevent arbitrary file write or deletion.
Jul 1, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026