CVE-2023-45190: Llama Index Arbitrary File Read via Path Traversal

Critical Vulnerability Information Vulnerability Description Vulnerability Type: Arbitrary file read through path traversal Affected Versions: run-llama/llama_index CVE ID: CVE-2023-45190 Severity: High Root Cause Analysis Root Cause: A critical flaw in the function, which fails to properly validate or sanitize user input, allowing attackers to access system files via path traversal sequences (e.g., ). Impact Information Disclosure: Attackers can access sensitive system files such as and . Privilege Escalation: If the server runs with elevated privileges, attackers may gain access to other system files or even take control of the server. Data Integrity: Attackers can tamper with data by overwriting existing files. Exploitation Method Attack Scenario: Attackers send malicious HTTP requests to the vulnerable Flask endpoint , using a forged parameter pointing to sensitive files on the server. Malicious Input Examples: - - Recommended Remediation Input Validation: Implement strict validation and sanitization of to ensure it does not contain path traversal sequences or absolute paths. File Access Restriction: Restrict file access to references within predefined secure directories only. Timeline Reported: One month ago Fix Status: Fixed Reward Amount: $1725

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2023-45190: Llama Index Arbitrary File Read via Path Traversal