CVE-2025-7647
Insecure Temporary File Handling in run-llama/llama_index
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Insecure Temporary File Handling in run-llama/llama_index
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
- Record
CVE-2025-7647- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-378
- Updated
- 2026-11-02
EUVDEUVD-2025-31429
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
- Record
EUVD-2025-31429- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cr7q-2w66-hjcm
llama-index-core insecurely handles temporary files
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
- Record
GHSA-cr7q-2w66-hjcm- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-378
- Updated
- 2026-11-02
NVD
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
- Record
CVE-2025-7647- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-378
- Updated
- 2026-11-02
OSV
Insecure Temporary File Handling in run-llama/llama_index
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
- Record
CVE-2025-7647- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-378
- Updated
- 2026-11-02
OSVGHSA-cr7q-2w66-hjcm
llama-index-core insecurely handles temporary files
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
- Record
GHSA-cr7q-2w66-hjcm- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-378
- Updated
- 2026-11-02
OSVPYSEC-2026-1562
llama-index-core insecurely handles temporary files
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
- Record
PYSEC-2026-1562- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
llama-index-corePyPI |
before 0.13.0 | 0.13.0 |
llama-index-corePyPI |
before 0.13.0, plus listed versions 0.10.00.10.10.10.100.10.110.10.11.post1 Show 45 moreShow less0.10.120.10.130.10.140.10.14.post10.10.150.10.160.10.16.post10.10.170.10.180.10.18.post10.10.190.10.20.10.200.10.20.post10.10.20.post20.10.20.post30.10.210.10.21.post10.10.220.10.230.10.23.post10.10.240.10.24.post10.10.24a10.10.250.10.25.post10.10.25.post20.10.25.post30.10.25a10.10.260.10.270.10.280.10.290.10.30.10.300.10.310.10.320.10.330.10.340.10.350.10.35.post10.10.360.10.370.10.37.post10.10.38 |
0.13.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-7647 is a high vulnerability (CVSS 7.3) in Run-llama Run-llama/llama Index, published September 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in llama-index-core 0.13.0.
References
huntr.com/bounties/a2baa08f-98bf-47a8-ac83-06f7411afd9e
github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4
nvd.nist.gov/vuln/detail/CVE-2025-7647
pypi.org/project/llama-index-core
Left out here: 176 versions. The JSON record has them.