> CVE-2025-67819

« BACK_TO_HOME
PUBLISHED
2025-12-12 17:15
MODIFIED
2025-12-12 17:15
EPSS (Prob. Exploit)
0.50%
Top 56.8%
DATA SOURCES:
NVD 🔗 2025-12-12 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-hmmh-292h-3364 HIGH

Weaviate OSS has path traversal vulnerability via the Shard Movement API

AFFECTED PACKAGES:
GO / github.com/weaviate/weaviate
>= 1.33.0-rc.0, < 1.33.4
Fixed in: 1.33.4
GO / github.com/weaviate/weaviate
>= 1.32.0-rc.0, < 1.32.16
Fixed in: 1.32.16
GO / github.com/weaviate/weaviate
>= 1.31.0-rc.0, < 1.31.19
Fixed in: 1.31.19
GO / github.com/weaviate/weaviate
>= 1.30.0, < 1.30.20
Fixed in: 1.30.20

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
ALIASES:
GHSA-hmmh-292h-3364, GO-2025-4238

> HISTORIQUE DES MODIFICATIONS

Première apparition
12/12/2025 17:15
Source: NVD
📊 ENRICHISSEMENT 19/01/2026 17:38
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/weaviate/weaviate
https://weaviate.io/blog/weaviate-security-release-november-2025
« BACK_TO_HOME