| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/weaviate/weaviate | ≥ 1.31.0-rc.0, < 1.31.19≥ 1.32.0-rc.0, < 1.32.16≥ 1.33.0-rc.0, < 1.33.4< 1.30.20 | 1.31.191.32.161.33.41.30.20 |
| weaviate | < 1.33.4 | 1.33.4 |
An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free