- CVSS
- MEDIUM · 5.3 v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Published
- 2026-04-02
- Weakness
- CWE-22
- Source
- nvd.nist.gov/vuln/detail/CVE-2026-34523
Description
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to version 1.17.0, a path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server’s filesystem. by sending percent-encoded ”../” sequences (%2E%2E%2F) in requests to static file routes, an attacker can check for the existence of files. This issue has been patched in version 1.17.0.
References
How GTK Cyber trains on this
AI security training at GTK Cyber covers the LLM and ML-pipeline vulnerability classes that vulnerabilities like CVE-2026-34523 fall into. Our hands-on courses are taught by Charles Givre and other practitioners who break and defend production AI systems.