{"id":"GO-2025-4238","revision":"f6daab49f78d4322a9496c24d1cb6799","records":[{"revision":"f6daab49f78d4322a9496c24d1cb6799","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4238","aliases":["CVE-2025-67819","GHSA-hmmh-292h-3364"],"title":"Weaviate OSS has path traversal vulnerability via the Shard Movement API in github.com/weaviate/weaviate","description":"Weaviate OSS has path traversal vulnerability via the Shard Movement API in github.com/weaviate/weaviate","state":0,"publishedAt":"2025-12-15T20:15:46+00:00","modifiedAt":"2026-03-03T04:57:47.645311+00:00","affected":[{"ecosystem":"Go","name":"github.com/weaviate/weaviate","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.30.0"},{"kind":"fixed","version":"1.30.20"},{"kind":"introduced","version":"1.31.0-rc.0"},{"kind":"fixed","version":"1.31.19"},{"kind":"introduced","version":"1.32.0-rc.0"},{"kind":"fixed","version":"1.32.16"},{"kind":"introduced","version":"1.33.0-rc.0"},{"kind":"fixed","version":"1.33.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/advisories/GHSA-hmmh-292h-3364","https://nvd.nist.gov/vuln/detail/CVE-2025-67819","https://github.com/weaviate/weaviate/commit/4ff2cc89277c264c37d0f7316d9eb6368cfc30ff","https://github.com/weaviate/weaviate/commit/89c2270869e6d64f5b5276b8626c11cd816c6665","https://github.com/weaviate/weaviate/commit/b18cc7ea82d80a61e7943361a6e335e3fd5a49c7","https://weaviate.io/blog/weaviate-security-release-november-2025"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4238","license":"OSV · upstream source license applies","key":"osv:GO-2025-4238","identifiers":["GO-2025-4238","CVE-2025-67819","GHSA-hmmh-292h-3364"]},"retained":false,"historicalAffected":[]}],"coverage":[]}