Skip to contentOobabooga Text-generation-webui vulnerabilities
- oobabooga text-generation-webui, text generation web ui +1 moretext-generation-webui has a Path Traversal in load_prompt() — .txt file read without authenticationCVE-2026-354875.3 Medium
- oobabooga text-generation-webui, text generation web ui +1 moretext-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validationCVE-2026-354867.5 High
- oobabooga text-generation-webui, textgen +1 moretext-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authenticationCVE-2026-354857.5 High
- oobabooga text-generation-webui, textgen +1 moretext-generation-webui has a Path Traversal in load_preset() — .yaml file read without authenticationCVE-2026-354845.3 Medium
- oobabooga text-generation-webui, textgen +1 moretext-generation-webui has a Path Traversal in load_template() — .jinja/.yaml/.yml file read without authenticationCVE-2026-354835.3 Medium
- oobabooga text-generation-webui, textgen +1 moretext-generation-webui affected by Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".CVE-2026-350509.1 Critical
- oobabooga text-generation-webuioobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityCVE-2025-124879.8 Critical
- oobabooga text-generation-webuioobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution VulnerabilityCVE-2025-124889.8 Critical
- oobabooga text-generation-webuitext-generation-webui allows arbitrary file read via symbolic link uploadCVE-2025-623646.2 Medium