{"id":"EUVD-2025-203094","revision":"7d58c3efb9fa42cdabde428cd0833839","records":[{"revision":"7d58c3efb9fa42cdabde428cd0833839","observedAt":"2026-11-01T01:16:04.805+00:00","statement":{"source":"euvd","id":"EUVD-2025-203094","aliases":["CVE-2025-67818","GHSA-7v39-2hx7-7c43"],"title":"An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restor…","description":"An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2,"severity":null}],"references":["https://github.com/weaviate/weaviate","https://weaviate.io/blog/weaviate-security-release-november-2025"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203094","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 12, 2025, 12:00:00 AM","dateUpdated":"Dec 12, 2025, 7:15:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-203094","identifiers":["EUVD-2025-203094","CVE-2025-67818","GHSA-7v39-2hx7-7c43"]},"retained":false,"historicalAffected":[]}],"coverage":[]}