Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_prompt() allows reading any .txt file on the server filesystem. The file content is returned verbatim in the API response. This vulnerability is fixed in 4.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-35487 Unauthenticated Path Traversal in text-generation-webui Before 4.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35487
Post summary
CVE-2026-35487 is an unauthenticated path traversal vulnerability affecting text‑generation‑webui versions before 4.3; no PoC, exploit, patch, or active exploitation has been reported in the text.
CVE-2026-35487 text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_prompt(… https://www.cve.org/CVERecord?id=CVE-2026-35487
Post summary
The tweet announces CVE-2026-35487, noting it as an unauthenticated path traversal vulnerability in text‑generation‑webui prior to version 4.3.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | oobabooga | text_generation_web_ui | - | - | - |