CVE-2026-34523: SillyTavern: Path Traversal allows file existence oracle

April 1, 2026 (updated April 6, 2026)

A path traversal vulnerability in the static file route handler allows any unauthenticated user to determine whether files exist anywhere on the server’s filesystem. By sending percent-encoded ../ sequences (%2E%2E%2F) in requests to static file routes, an attacker can check for the existence of files (404 if it doesn’t exist, 403 means it exists).

References

github.com/SillyTavern/SillyTavern
github.com/SillyTavern/SillyTavern/releases/tag/1.17.0
github.com/SillyTavern/SillyTavern/security/advisories/GHSA-525j-2hrj-m8fp
github.com/advisories/GHSA-525j-2hrj-m8fp
nvd.nist.gov/vuln/detail/CVE-2026-34523

Code Behaviors & Features

Detect and mitigate CVE-2026-34523 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →