Oobabooga vulnerabilities

Products

• Text-generation-webui 9
• Textgen 4
• Text Generation Web Ui 2

Newest

• oobabooga text-generation-webui, text generation web ui +1 more text-generation-webui has a Path Traversal in load_prompt() — .txt file read without authentication CVE-2026-35487 5.3 MediumApril 7, 2026
• oobabooga text-generation-webui, text generation web ui +1 more text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation CVE-2026-35486 7.5 HighApril 7, 2026
• oobabooga text-generation-webui, textgen +1 more text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authentication CVE-2026-35485 7.5 HighApril 7, 2026
• oobabooga text-generation-webui, textgen +1 more text-generation-webui has a Path Traversal in load_preset() — .yaml file read without authentication CVE-2026-35484 5.3 MediumApril 7, 2026
• oobabooga text-generation-webui, textgen +1 more text-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authentication CVE-2026-35483 5.3 MediumApril 7, 2026
• oobabooga text-generation-webui, textgen +1 more text-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml". CVE-2026-35050 9.1 CriticalApril 6, 2026
• oobabooga text-generation-webui oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability CVE-2025-12487 9.8 CriticalNovember 6, 2025
• oobabooga text-generation-webui oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability CVE-2025-12488 9.8 CriticalNovember 6, 2025
• oobabooga text-generation-webui text-generation-webui allows arbitrary file read via symbolic link upload CVE-2025-62364 6.2 MediumOctober 13, 2025