CVE-2026-35050CWE-22path-traversal

CVE-2026-35050

Critical · published April 6, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py" file could be overwritten. Then, this python file can be triggered to get executed from "Model" menu when requesting to download a new model. This vulnerability is fixed in 4.1.1.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00600 · 48.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-06T22:16Z
Affected products (1)
ProductVersionsFixed in
oobabooga/textgen< 4.1.14.1.1
References (1)
https://github.com/oobabooga/text-generation-webui/security/advisories/GHSA-jg96-p5p6-q3cv · [email protected]
EPSS history
Timeline
  • 06 APR 17:30Z
    text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".
    cvelistv5