Cloudanix VulnDB

CVE-2025-67819

High · 7.5

Weaviate OSS has path traversal vulnerability via the Shard Movement API

CVSS

7.5

EPSS

0.5%

Published

Dec 12, 2025

CISA due date

—

The record

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/weaviate/weaviate 1.30.0 1.30.20
Go github.com/weaviate/weaviate 1.31.0-rc.0 1.31.19
Go github.com/weaviate/weaviate 1.32.0-rc.0 1.32.16
Go github.com/weaviate/weaviate 1.33.0-rc.0 1.33.4
go github.com/weaviate/weaviate 1.30.0 1.30.20
go github.com/weaviate/weaviate 1.31.0-rc.0 1.31.19
go github.com/weaviate/weaviate 1.32.0-rc.0 1.32.16
go github.com/weaviate/weaviate 1.33.0-rc.0 1.33.4
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251230T014957-150000.1.134.1

Related vulnerabilities