A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary files on the server, including sensitive system files. The issue arises due to improper validation or sanitization of the file path, enabling path traversal sequences to access files outside the intended directory. The vulnerability is fixed in version 0.12.41.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274 | Patch |
| https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68 | Exploit Third Party Advisory |
| https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68 | Exploit Third Party Advisory |
Configurations
History
30 Jul 2025, 20:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* | |
| First Time |
Llamaindex llamaindex
Llamaindex |
|
| References | () https://huntr.com/bounties/e89d14f8-bfe8-4c9a-bb2a-656c01cc9a68 - Exploit, Third Party Advisory | |
| References | () https://github.com/run-llama/llama_index/commit/cdeaab91a204d1c3527f177dac37390327aef274 - Patch |
07 Jul 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
07 Jul 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-07 13:15
Updated : 2025-07-30 20:01
NVD link : CVE-2025-6209
Mitre link : CVE-2025-6209
JSON object : View
Products Affected
llamaindex
- llamaindex
CWE
No CWE.