{"id":"EUVD-2025-203094","enisaUuid":"ae1f1661-dc4b-39ee-abbb-ad49eb03fc80","description":"An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application\u0027s privilege scope.","datePublished":"Dec 12, 2025, 12:00:00 AM","dateUpdated":"Dec 12, 2025, 7:15:25 PM","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/weaviate/weaviate\nhttps://weaviate.io/blog/weaviate-security-release-november-2025\n","aliases":"CVE-2025-67818\nGHSA-7v39-2hx7-7c43\n","assigner":"mitre","epss":0.91,"enisaIdProduct":[{"id":"47c2ad17-3f3c-3419-a250-fd7ba67925fd","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"b0fff1e3-6c8c-390b-8244-bc0121c6ebef","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"a31bacae-6186-3d22-bba8-5d7770eab5fb","vulnerability":{"id":"GHSA-7v39-2hx7-7c43","description":"Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip","datePublished":"Dec 12, 2025, 6:30:35 PM","dateUpdated":"Dec 18, 2025, 1:07:10 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-67818\nhttps://github.com/weaviate/weaviate/commit/169df2dc92bc232df62e8fab0a20db2e5371f7aa\nhttps://github.com/weaviate/weaviate/commit/89c2270869e6d64f5b5276b8626c11cd816c6665\nhttps://github.com/advisories/GHSA-7v39-2hx7-7c43\nhttps://github.com/weaviate/weaviate\nhttps://weaviate.io/blog/weaviate-security-release-november-2025\n","enisa_id":"EUVD-2025-203094\n","aliases":"GHSA-7v39-2hx7-7c43\nCVE-2025-67818\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:52:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a6abf7ff-0ba7-3318-aff1-72d93ba4a8df","vulnerability":{"id":"CVE-2025-67818","description":"An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application\u0027s privilege scope.","datePublished":"Dec 12, 2025, 12:00:00 AM","dateUpdated":"Dec 12, 2025, 7:15:25 PM","status":"PUBLISHED","baseScore":7.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/weaviate/weaviate\nhttps://weaviate.io/blog/weaviate-security-release-november-2025\n","enisa_id":"EUVD-2025-203094\n","assigner":"mitre","epss":0.91,"dataProcessed":"Oct 27, 2026, 7:20:46 AM","vulnerabilityProduct":[{"id":"675e9599-fec6-3ba0-8215-d8b058c8ce14","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"c3905a50-bb1f-3ba2-a4b1-e3b206ba97fe","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[]}