CVE-2026-34522
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
SillyTavern before version 1.17.0 contains a path traversal vulnerability in /api/chats/import, allowing authenticated attackers to write files outside the intended chats directory by injecting traversal sequences into character_name.
Risk Assessment
Authenticated attackers can overwrite critical system files or upload malicious files, potentially leading to remote code execution or privilege escalation.
Recommendation
Update SillyTavern to version 1.17.0 or later. In the meantime, restrict access to the /api/chats/import endpoint and validate input.
Other vulnerabilities in SillyTavern
See all- CVE-2026-44650Critical
SillyTavern before version 1.18.0 has a vulnerability in the POST /api/extensions/delete endpoint that allows deletion of the entire user extensions directory by sending extensionName "." (dot). The sanitize-filename validation is bypassed, and no authentication is required in the default configuration.
- CVE-2026-44649Critical
SillyTavern, a locally installed user interface, accepts Remote-User and X-Authentik-Username HTTP headers for automatic login when SSO is configured, without validating they originate from a trusted proxy.
- CVE-2026-46372High
Vulnerability in SillyTavern before version 1.18.0. The /api/search/searxng endpoint accepts attacker-controlled baseUrl, enabling requests to internal or loopback HTTP services.
- CVE-2026-44652Medium
SillyTavern before version 1.18.0 contains an SSRF vulnerability in corsProxyMiddleware, which forwards the URL from req.params.url directly into fetch(). Only circular requests to its own host are blocked, with no destination allowlist or private/loopback restrictions.
- CVE-2026-44651Medium
SillyTavern before version 1.18.0 does not HTML-escape attacker-controlled URL values before sending them in error responses. This allows cross-site scripting (XSS) via crafted requests.
- CVE-2026-44648High
SillyTavern before version 1.18.0 uses cookie-session for authentication, storing session data in a signed cookie. Password change endpoints do not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access after a password change.
- CVE-2026-34526Medium
In SillyTavern prior to version 1.17.0, an SSRF vulnerability was found in the search.js function. Hostname validation only covers dotted-quad IPv4, allowing bypass via localhost, IPv6, and DNS names resolving to internal addresses. A port check limits exploitation to default ports, reducing risk.
- CVE-2026-34524High
SillyTavern prior to version 1.17.0 contains a path traversal vulnerability in chat endpoints that allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0.
- CVE-2026-34523Medium
SillyTavern before version 1.17.0 has a path traversal vulnerability in static file handling. An unauthenticated attacker can check for the existence of arbitrary files on the server by sending percent-encoded "../" sequences.
Original NVD description (English source)
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0.