CVE-2025-67818
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-22
Limitación incorrecta de nombre de ruta a un directorio restringido (Path Traversal)
Fecha de publicación:
12/12/2025
Última modificación:
12/12/2025
Descripción
*** Pendiente de traducción *** An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.
Impacto
Puntuación base 3.x
7.20
Gravedad 3.x
ALTA