Описание
A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. The vulnerability arises from inadequate handling of hardlinks in the load_data() method, where the security checks fail to differentiate between real files and hardlinks. This issue is resolved in version 0.5.2.
Ссылки
- Patch
- ExploitThird Party Advisory
Уязвимые конфигурации
EPSS
6.2 Medium
CVSS3
Дефекты
Связанные уязвимости
A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. The vulnerability arises from inadequate handling of hardlinks in the load_data() method, where the security checks fail to differentiate between real files and hardlinks. This issue is resolved in version 0.5.2.
LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit
Уязвимость функции load_data() файла llama_index/readers/obsidian/base.py плагина ObsidianReader, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
6.2 Medium
CVSS3