CVE-2026-35487

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_prompt() allows reading any .txt file on the server filesystem. The file content is returned verbatim in the API response. This vulnerability is fixed in 4.3.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-04-07

Last modified

2026-10-25

Weaknesses

CWE-22

Affected products

• Text-generation-webui (Oobabooga)
• Text Generation Web Ui (Oobabooga)

References

• https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-mfgg-vvc6-vqq7