A path traversal vulnerability in the LlamaIndex ObsidianReader component, affecting versions 0.12.23 through 0.12.28, enables unauthorized remote access to sensitive system files.

This is a path traversal flaw (CWE-22) residing in the ObsidianReader class, which fails to resolve symbolic links to their real paths or validate that access remains within the designated vault directory. The vulnerability is exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/PR:N/UI:N.

The ability to read arbitrary files from the host system poses a significant risk of sensitive information disclosure, including configuration files, credentials, or proprietary data. Given the CVSS score of 7.5, this high-severity vulnerability could lead to a full compromise of confidentiality for the affected environment. Unauthorized access to these files may further enable lateral movement or provide attackers with the necessary intelligence to escalate their impact on the organization.

Immediate Action: Update the llama-index-readers-obsidian package to version 0.5.1 or later to implement the necessary path validation fixes.

Proactive Monitoring: Monitor file access logs for unusual patterns or attempts to access directories outside of the configured Obsidian vault.

Compensating Controls: Ensure that the application process is running with the principle of least privilege, restricting its file system access to only the directories absolutely required for operation.

Public Exploit Available: No (exploit_available: unknown).

Organizations utilizing the LlamaIndex ObsidianReader must prioritize patching to version 0.5.1 immediately. Because this vulnerability allows for unauthenticated arbitrary file reads, the risk of data exfiltration is substantial. Security teams should verify their environment for the affected versions and apply the update to prevent potential exploitation of this path traversal mechanism.