{"id":"GHSA-hmmh-292h-3364","revision":"dd6d6ae6e6784ffa99adf95d42a57add","records":[{"revision":"dd6d6ae6e6784ffa99adf95d42a57add","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-hmmh-292h-3364","aliases":["CVE-2025-67819","GO-2025-4238"],"title":"Weaviate OSS has path traversal vulnerability via the Shard Movement API","description":"An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the \"Pause file activity\" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process.","state":0,"publishedAt":"2025-12-12T18:30:35+00:00","modifiedAt":"2025-12-18T01:11:41.740121+00:00","affected":[{"ecosystem":"Go","name":"github.com/weaviate/weaviate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.30.0"},{"kind":"fixed","version":"1.30.20"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/weaviate/weaviate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.31.0-rc.0"},{"kind":"fixed","version":"1.31.19"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/weaviate/weaviate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.32.0-rc.0"},{"kind":"fixed","version":"1.32.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/weaviate/weaviate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.33.0-rc.0"},{"kind":"fixed","version":"1.33.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-67819","https://github.com/weaviate/weaviate/commit/4ff2cc89277c264c37d0f7316d9eb6368cfc30ff","https://github.com/weaviate/weaviate/commit/89c2270869e6d64f5b5276b8626c11cd816c6665","https://github.com/weaviate/weaviate/commit/b18cc7ea82d80a61e7943361a6e335e3fd5a49c7","https://github.com/advisories/GHSA-hmmh-292h-3364","https://github.com/weaviate/weaviate","https://weaviate.io/blog/weaviate-security-release-november-2025"],"sourceUrl":"https://github.com/advisories/GHSA-hmmh-292h-3364","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-hmmh-292h-3364","identifiers":["GHSA-hmmh-292h-3364","CVE-2025-67819","GO-2025-4238"]},"retained":false,"historicalAffected":[]}],"coverage":[]}