An unauthenticated path traversal vulnerability in Oobabooga text-generation-webui versions prior to 4.3 allows remote attackers to read sensitive files from the underlying server.

This is a path traversal vulnerability (CWE-22) triggered by the lack of server-side validation for dropdown values in the load_grammar function. An unauthenticated remote attacker can submit crafted POST requests containing directory traversal sequences to access any file on the host system.

The ability to read arbitrary files on the server poses a significant risk to confidentiality. An attacker could potentially retrieve configuration files, credentials, or sensitive system data, leading to full system compromise or lateral movement within the network. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration.

Immediate Action: Update the Oobabooga text-generation-webui software to version 4.3 or later to apply the necessary input validation fixes.

Proactive Monitoring: Review web server access logs for suspicious POST requests containing directory traversal characters, such as double dots and forward slashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and restrict access to the API endpoints used by the interface.

Public Exploit Available: Unknown.

Given the ease of exploitation for this path traversal vulnerability and the associated risk of sensitive data exposure, users must prioritize upgrading to version 4.3 immediately. Organizations should assess their current deployment of text-generation-webui and verify that the latest patches have been applied across all instances to eliminate this critical security gap.