CVE-2026-34524
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
SillyTavern prior to version 1.17.0 contains a path traversal vulnerability in chat endpoints that allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0.
Risk Assessment
The organization is at risk of leakage of sensitive configuration files and secrets, potentially leading to user account takeover and further attacks.
Recommendation
Immediately upgrade SillyTavern to version 1.17.0 or later. Restrict application access to trusted users only.
Other vulnerabilities in SillyTavern
See all- CVE-2026-44650Critical
SillyTavern before version 1.18.0 has a vulnerability in the POST /api/extensions/delete endpoint that allows deletion of the entire user extensions directory by sending extensionName "." (dot). The sanitize-filename validation is bypassed, and no authentication is required in the default configuration.
- CVE-2026-44649Critical
SillyTavern, a locally installed user interface, accepts Remote-User and X-Authentik-Username HTTP headers for automatic login when SSO is configured, without validating they originate from a trusted proxy.
- CVE-2026-46372High
Vulnerability in SillyTavern before version 1.18.0. The /api/search/searxng endpoint accepts attacker-controlled baseUrl, enabling requests to internal or loopback HTTP services.
- CVE-2026-44652Medium
SillyTavern before version 1.18.0 contains an SSRF vulnerability in corsProxyMiddleware, which forwards the URL from req.params.url directly into fetch(). Only circular requests to its own host are blocked, with no destination allowlist or private/loopback restrictions.
- CVE-2026-44651Medium
SillyTavern before version 1.18.0 does not HTML-escape attacker-controlled URL values before sending them in error responses. This allows cross-site scripting (XSS) via crafted requests.
- CVE-2026-44648High
SillyTavern before version 1.18.0 uses cookie-session for authentication, storing session data in a signed cookie. Password change endpoints do not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access after a password change.
- CVE-2026-34526Medium
In SillyTavern prior to version 1.17.0, an SSRF vulnerability was found in the search.js function. Hostname validation only covers dotted-quad IPv4, allowing bypass via localhost, IPv6, and DNS names resolving to internal addresses. A port check limits exploitation to default ports, reducing risk.
- CVE-2026-34523Medium
SillyTavern before version 1.17.0 has a path traversal vulnerability in static file handling. An unauthenticated attacker can check for the existence of arbitrary files on the server by sending percent-encoded "../" sequences.
- CVE-2026-34522High
SillyTavern before version 1.17.0 contains a path traversal vulnerability in /api/chats/import, allowing authenticated attackers to write files outside the intended chats directory by injecting traversal sequences into character_name.
Original NVD description (English source)
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0.