Textgen vulnerabilities

2 known vulnerabilities in Textgen from Oobabooga. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  text-generation-webui: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-35485Apr 7, 2026Oobabooga

  text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does

• 8.8 High severity

  text-generation-webui: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-35050Apr 6, 2026Oobabooga

  text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.1.1, users can save extention settings in "py" format and in the app root directory. This allows to overwrite python files, for instance the "download-model.py"